bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/ism/guidelines-overview.md

@@ -1,183 +1,183 @@
-# ISM — 22 Guideline Chapters Overview
-
-Source: Australian Information Security Manual, March 2026 edition  
-Published by: Australian Signals Directorate (ASD)  
-URL: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism
-
----
-
-## Chapter Summary Table
-
-| # | Chapter | Domain | Key Control Areas |
-|---|---------|--------|------------------|
-| 1 | Cyber Security Roles | Governance | CISO appointment, security responsibilities, accountability structures, security culture |
-| 2 | Cyber Security Incidents | Detect/Respond | Incident definition, reporting obligations, response procedures, ASD notification |
-| 3 | Procurement & Outsourcing | Governance | Supply chain security, vendor assessment, cloud service security requirements |
-| 4 | Cyber Security Documentation | Governance | SSP, risk register, security policies, document classification and review |
-| 5 | Physical Security | Protect | Secure areas, physical access controls, equipment security, clean desk |
-| 6 | Personnel Security | Protect | Personnel screening, security clearances, user awareness, termination procedures |
-| 7 | Communications Infrastructure | Protect | Cabling, network zoning, physical comms protection, signal security |
-| 8 | Communications Systems | Protect | Voice systems, video conferencing, fax and messaging security |
-| 9 | Enterprise Mobility | Protect | Mobile devices, BYOD, remote access, mobile device management (MDM) |
-| 10 | Evaluated Products | Protect | Use of evaluated/certified products (Common Criteria, FIPS), cryptographic modules |
-| 11 | IT Equipment | Protect | Hardware procurement, asset register, equipment disposal, TEMPEST |
-| 12 | Media | Protect | Removable media controls, media sanitisation, media destruction |
-| 13 | System Hardening | Protect | OS hardening, application hardening, firmware security, least privilege |
-| 14 | System Management | Protect | Patch management, change management, backups, configuration management |
-| 15 | System Monitoring | Detect | Logging requirements, SIEM, anomaly detection, audit log retention |
-| 16 | Software Development | Protect | Secure SDLC, code review, dependency management, vulnerability disclosure |
-| 17 | Database Systems | Protect | Database hardening, access controls, encryption at rest, query controls |
-| 18 | Email | Protect | Email filtering, DMARC/SPF/DKIM, email content security, phishing controls |
-| 19 | Networking | Protect | Network segmentation, firewall rules, DNS security, VPN standards |
-| 20 | Cryptography | Protect | Approved algorithms, key management, PKI, TLS standards |
-| 21 | Gateways | Protect | Content filtering, data diodes, cross-domain solutions, proxy security |
-| 22 | Data Transfers | Protect | Approved transfer methods, data labelling, transfer logging |
-
----
-
-## Chapter Detail
-
-### Chapter 1 — Cyber Security Roles
-- Organisations must appoint a Chief Information Security Officer (CISO) with appropriate authority
-- Security responsibilities must be defined across all levels of the organisation
-- A system owner must be designated for each ICT system
-- Key controls cover: CISO role definition, security advisor appointments, escalation paths
-
-### Chapter 2 — Cyber Security Incidents
-- Defines a cyber security incident as any actual or suspected compromise of a system's confidentiality, integrity, or availability
-- ASD must be notified of significant incidents — especially for systems handling PROTECTED and above
-- Response procedures must be documented and tested
-- Incident evidence must be preserved; post-incident reviews required
-- Key controls: incident categorisation, notification timelines, forensic preservation, lessons learned
-
-### Chapter 3 — Procurement & Outsourcing
-- All ICT procurement must consider cyber security requirements before purchase
-- Cloud services must be assessed for compliance with the ISM and ASD Cloud Security Guidance
-- Outsourced services must contractually require ISM-aligned security controls
-- Supply chain risks must be assessed and managed
-- Key controls: vendor security assessments, contract clauses, cloud service provider evaluation
-
-### Chapter 4 — Cyber Security Documentation
-- Every system must have a current System Security Plan (SSP) — the primary authorisation document
-- Risk registers must be maintained and reviewed
-- Security policies and procedures must be version-controlled, approved by management, and reviewed at least annually
-- Key documents: SSP, risk register, incident response plan, change management plan, business continuity plan
-
-### Chapter 5 — Physical Security
-- Secure areas must be established and access controlled
-- Visitors must be escorted in secure areas
-- Equipment must be protected from physical tampering
-- Clean desk and clear screen policies required
-- Key controls: physical access logs, secure area classifications, equipment labelling
-
-### Chapter 6 — Personnel Security
-- Personnel must be screened before access to sensitive systems
-- Security clearances must match the classification level of systems accessed
-- Security awareness training must be provided at onboarding and annually
-- Access must be revoked promptly on termination
-- Key controls: background checks, clearance validation, training records, offboarding checklist
-
-### Chapter 7 — Communications Infrastructure
-- Cabling must be protected from interception and damage
-- Network zones must be established with appropriate separation
-- Physical communications infrastructure in secure areas must be physically protected
-- Key controls: cable labelling, conduit requirements, zone separation
-
-### Chapter 8 — Communications Systems
-- Voice over IP (VoIP) and video conferencing systems must be secured
-- PSTN systems connected to secure networks require additional controls
-- Fax and messaging systems handling sensitive information must use approved encryption
-- Key controls: VoIP hardening, conferencing system security, messaging encryption
-
-### Chapter 9 — Enterprise Mobility
-- Mobile devices accessing government systems must be enrolled in an approved MDM solution
-- BYOD must be managed through containerisation or equivalent
-- Remote access must use approved VPN with MFA
-- Lost or stolen devices must be remotely wipeable
-- Key controls: MDM enrolment, remote wipe capability, MFA for remote access, mobile app vetting
-
-### Chapter 10 — Evaluated Products
-- Systems handling PROTECTED and above must use cryptographic products evaluated or approved by ASD
-- Common Criteria evaluated products are preferred for high-assurance environments
-- FIPS 140-2/3 validated modules required for classified cryptographic operations
-- Key controls: product evaluation requirements, cryptographic module validation
-
-### Chapter 11 — IT Equipment
-- All ICT equipment must be recorded in an asset register
-- Equipment must be disposed of securely (data sanitisation before disposal)
-- Equipment in sensitive areas may require TEMPEST certification
-- Key controls: asset register, equipment disposal procedures, TEMPEST assessment
-
-### Chapter 12 — Media
-- Removable media must be controlled and authorised
-- Media used in classified environments must be treated at the classification level of the system
-- Media must be sanitised (overwrite/degauss) or destroyed before disposal
-- Key controls: removable media register, sanitisation procedures, destruction certificates
-
-### Chapter 13 — System Hardening
-- Operating systems must be hardened before deployment (remove unnecessary services, disable default accounts)
-- Applications must be hardened (disable unused features, apply vendor hardening guides)
-- Firmware security settings must be configured (Secure Boot, BIOS passwords)
-- Least privilege must be enforced — no standing administrative access
-- Key controls: OS hardening checklists, application allow-listing, firmware configuration, privileged access management
-
-### Chapter 14 — System Management
-- Critical patches must be applied within defined timeframes (14 days for critical, 30 days for non-critical)
-- Change management must follow a documented and approved process
-- Backups must be tested regularly; backup media must be stored securely
-- Configuration management must track all changes to system baseline
-- Key controls: patch management SLAs, backup testing schedule, change approval process
-
-### Chapter 15 — System Monitoring
-- Centralised event logging must be implemented (SIEM or equivalent)
-- Log retention: minimum 18 months for systems handling PROTECTED and above
-- Anomalous events must trigger alerts and investigation
-- Privileged access and system changes must be logged
-- Key controls: log collection scope, retention periods, alerting thresholds, log integrity
-
-### Chapter 16 — Software Development
-- Software development must follow a secure Software Development Life Cycle (SDLC)
-- Code reviews and vulnerability testing required before deployment
-- Third-party dependencies must be tracked and patched
-- Vulnerability disclosure policy required for externally facing systems
-- Key controls: SDLC documentation, code review evidence, dependency scanning, pen testing
-
-### Chapter 17 — Database Systems
-- Databases must be hardened (remove default accounts, disable unnecessary features)
-- Access to databases must follow least privilege
-- Sensitive data at rest must be encrypted
-- Database activity must be logged
-- Key controls: database hardening checklist, access control matrix, encryption at rest, query logging
-
-### Chapter 18 — Email
-- Email gateways must implement DMARC, DKIM, and SPF
-- Email filtering must block malicious attachments and phishing content
-- Outbound emails containing sensitive information must be controlled
-- Key controls: DMARC policy (reject), DKIM signing, SPF records, gateway filtering logs
-
-### Chapter 19 — Networking
-- Network segmentation must separate sensitive systems from general-purpose networks
-- Firewall rule sets must be documented, reviewed, and audited
-- DNS security extensions (DNSSEC) recommended
-- VPNs must use approved encryption standards
-- Key controls: network architecture diagram, firewall rule review schedule, DNSSEC configuration
-
-### Chapter 20 — Cryptography
-- Only ASD-approved cryptographic algorithms must be used
-- TLS 1.2 minimum (TLS 1.3 preferred) for data in transit
-- Key management must follow documented procedures (generation, storage, rotation, destruction)
-- PKI must be underpinned by a trusted root CA
-- Key controls: algorithm approval list, key management procedures, TLS version configuration, CA management
-
-### Chapter 21 — Gateways
-- Internet gateways must implement web content filtering
-- Cross-domain solutions (CDS) required for moving information between classification levels
-- Data diodes used for one-way transfers in high-security environments
-- Gateway security must be regularly assessed
-- Key controls: content filtering policy, CDS accreditation, gateway security assessments
-
-### Chapter 22 — Data Transfers
-- Data transfers between different classification domains must use approved methods
-- All transfers of classified data must be logged
-- Data must be labelled with its protective marking before transfer
-- Key controls: approved transfer mechanisms, transfer logs, label verification procedures
+# ISM — 22 Guideline Chapters Overview
+
+Source: Australian Information Security Manual, March 2026 edition  
+Published by: Australian Signals Directorate (ASD)  
+URL: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism
+
+---
+
+## Chapter Summary Table
+
+| # | Chapter | Domain | Key Control Areas |
+|---|---------|--------|------------------|
+| 1 | Cyber Security Roles | Governance | CISO appointment, security responsibilities, accountability structures, security culture |
+| 2 | Cyber Security Incidents | Detect/Respond | Incident definition, reporting obligations, response procedures, ASD notification |
+| 3 | Procurement & Outsourcing | Governance | Supply chain security, vendor assessment, cloud service security requirements |
+| 4 | Cyber Security Documentation | Governance | SSP, risk register, security policies, document classification and review |
+| 5 | Physical Security | Protect | Secure areas, physical access controls, equipment security, clean desk |
+| 6 | Personnel Security | Protect | Personnel screening, security clearances, user awareness, termination procedures |
+| 7 | Communications Infrastructure | Protect | Cabling, network zoning, physical comms protection, signal security |
+| 8 | Communications Systems | Protect | Voice systems, video conferencing, fax and messaging security |
+| 9 | Enterprise Mobility | Protect | Mobile devices, BYOD, remote access, mobile device management (MDM) |
+| 10 | Evaluated Products | Protect | Use of evaluated/certified products (Common Criteria, FIPS), cryptographic modules |
+| 11 | IT Equipment | Protect | Hardware procurement, asset register, equipment disposal, TEMPEST |
+| 12 | Media | Protect | Removable media controls, media sanitisation, media destruction |
+| 13 | System Hardening | Protect | OS hardening, application hardening, firmware security, least privilege |
+| 14 | System Management | Protect | Patch management, change management, backups, configuration management |
+| 15 | System Monitoring | Detect | Logging requirements, SIEM, anomaly detection, audit log retention |
+| 16 | Software Development | Protect | Secure SDLC, code review, dependency management, vulnerability disclosure |
+| 17 | Database Systems | Protect | Database hardening, access controls, encryption at rest, query controls |
+| 18 | Email | Protect | Email filtering, DMARC/SPF/DKIM, email content security, phishing controls |
+| 19 | Networking | Protect | Network segmentation, firewall rules, DNS security, VPN standards |
+| 20 | Cryptography | Protect | Approved algorithms, key management, PKI, TLS standards |
+| 21 | Gateways | Protect | Content filtering, data diodes, cross-domain solutions, proxy security |
+| 22 | Data Transfers | Protect | Approved transfer methods, data labelling, transfer logging |
+
+---
+
+## Chapter Detail
+
+### Chapter 1 — Cyber Security Roles
+- Organisations must appoint a Chief Information Security Officer (CISO) with appropriate authority
+- Security responsibilities must be defined across all levels of the organisation
+- A system owner must be designated for each ICT system
+- Key controls cover: CISO role definition, security advisor appointments, escalation paths
+
+### Chapter 2 — Cyber Security Incidents
+- Defines a cyber security incident as any actual or suspected compromise of a system's confidentiality, integrity, or availability
+- ASD must be notified of significant incidents — especially for systems handling PROTECTED and above
+- Response procedures must be documented and tested
+- Incident evidence must be preserved; post-incident reviews required
+- Key controls: incident categorisation, notification timelines, forensic preservation, lessons learned
+
+### Chapter 3 — Procurement & Outsourcing
+- All ICT procurement must consider cyber security requirements before purchase
+- Cloud services must be assessed for compliance with the ISM and ASD Cloud Security Guidance
+- Outsourced services must contractually require ISM-aligned security controls
+- Supply chain risks must be assessed and managed
+- Key controls: vendor security assessments, contract clauses, cloud service provider evaluation
+
+### Chapter 4 — Cyber Security Documentation
+- Every system must have a current System Security Plan (SSP) — the primary authorisation document
+- Risk registers must be maintained and reviewed
+- Security policies and procedures must be version-controlled, approved by management, and reviewed at least annually
+- Key documents: SSP, risk register, incident response plan, change management plan, business continuity plan
+
+### Chapter 5 — Physical Security
+- Secure areas must be established and access controlled
+- Visitors must be escorted in secure areas
+- Equipment must be protected from physical tampering
+- Clean desk and clear screen policies required
+- Key controls: physical access logs, secure area classifications, equipment labelling
+
+### Chapter 6 — Personnel Security
+- Personnel must be screened before access to sensitive systems
+- Security clearances must match the classification level of systems accessed
+- Security awareness training must be provided at onboarding and annually
+- Access must be revoked promptly on termination
+- Key controls: background checks, clearance validation, training records, offboarding checklist
+
+### Chapter 7 — Communications Infrastructure
+- Cabling must be protected from interception and damage
+- Network zones must be established with appropriate separation
+- Physical communications infrastructure in secure areas must be physically protected
+- Key controls: cable labelling, conduit requirements, zone separation
+
+### Chapter 8 — Communications Systems
+- Voice over IP (VoIP) and video conferencing systems must be secured
+- PSTN systems connected to secure networks require additional controls
+- Fax and messaging systems handling sensitive information must use approved encryption
+- Key controls: VoIP hardening, conferencing system security, messaging encryption
+
+### Chapter 9 — Enterprise Mobility
+- Mobile devices accessing government systems must be enrolled in an approved MDM solution
+- BYOD must be managed through containerisation or equivalent
+- Remote access must use approved VPN with MFA
+- Lost or stolen devices must be remotely wipeable
+- Key controls: MDM enrolment, remote wipe capability, MFA for remote access, mobile app vetting
+
+### Chapter 10 — Evaluated Products
+- Systems handling PROTECTED and above must use cryptographic products evaluated or approved by ASD
+- Common Criteria evaluated products are preferred for high-assurance environments
+- FIPS 140-2/3 validated modules required for classified cryptographic operations
+- Key controls: product evaluation requirements, cryptographic module validation
+
+### Chapter 11 — IT Equipment
+- All ICT equipment must be recorded in an asset register
+- Equipment must be disposed of securely (data sanitisation before disposal)
+- Equipment in sensitive areas may require TEMPEST certification
+- Key controls: asset register, equipment disposal procedures, TEMPEST assessment
+
+### Chapter 12 — Media
+- Removable media must be controlled and authorised
+- Media used in classified environments must be treated at the classification level of the system
+- Media must be sanitised (overwrite/degauss) or destroyed before disposal
+- Key controls: removable media register, sanitisation procedures, destruction certificates
+
+### Chapter 13 — System Hardening
+- Operating systems must be hardened before deployment (remove unnecessary services, disable default accounts)
+- Applications must be hardened (disable unused features, apply vendor hardening guides)
+- Firmware security settings must be configured (Secure Boot, BIOS passwords)
+- Least privilege must be enforced — no standing administrative access
+- Key controls: OS hardening checklists, application allow-listing, firmware configuration, privileged access management
+
+### Chapter 14 — System Management
+- Critical patches must be applied within defined timeframes (14 days for critical, 30 days for non-critical)
+- Change management must follow a documented and approved process
+- Backups must be tested regularly; backup media must be stored securely
+- Configuration management must track all changes to system baseline
+- Key controls: patch management SLAs, backup testing schedule, change approval process
+
+### Chapter 15 — System Monitoring
+- Centralised event logging must be implemented (SIEM or equivalent)
+- Log retention: minimum 18 months for systems handling PROTECTED and above
+- Anomalous events must trigger alerts and investigation
+- Privileged access and system changes must be logged
+- Key controls: log collection scope, retention periods, alerting thresholds, log integrity
+
+### Chapter 16 — Software Development
+- Software development must follow a secure Software Development Life Cycle (SDLC)
+- Code reviews and vulnerability testing required before deployment
+- Third-party dependencies must be tracked and patched
+- Vulnerability disclosure policy required for externally facing systems
+- Key controls: SDLC documentation, code review evidence, dependency scanning, pen testing
+
+### Chapter 17 — Database Systems
+- Databases must be hardened (remove default accounts, disable unnecessary features)
+- Access to databases must follow least privilege
+- Sensitive data at rest must be encrypted
+- Database activity must be logged
+- Key controls: database hardening checklist, access control matrix, encryption at rest, query logging
+
+### Chapter 18 — Email
+- Email gateways must implement DMARC, DKIM, and SPF
+- Email filtering must block malicious attachments and phishing content
+- Outbound emails containing sensitive information must be controlled
+- Key controls: DMARC policy (reject), DKIM signing, SPF records, gateway filtering logs
+
+### Chapter 19 — Networking
+- Network segmentation must separate sensitive systems from general-purpose networks
+- Firewall rule sets must be documented, reviewed, and audited
+- DNS security extensions (DNSSEC) recommended
+- VPNs must use approved encryption standards
+- Key controls: network architecture diagram, firewall rule review schedule, DNSSEC configuration
+
+### Chapter 20 — Cryptography
+- Only ASD-approved cryptographic algorithms must be used
+- TLS 1.2 minimum (TLS 1.3 preferred) for data in transit
+- Key management must follow documented procedures (generation, storage, rotation, destruction)
+- PKI must be underpinned by a trusted root CA
+- Key controls: algorithm approval list, key management procedures, TLS version configuration, CA management
+
+### Chapter 21 — Gateways
+- Internet gateways must implement web content filtering
+- Cross-domain solutions (CDS) required for moving information between classification levels
+- Data diodes used for one-way transfers in high-security environments
+- Gateway security must be regularly assessed
+- Key controls: content filtering policy, CDS accreditation, gateway security assessments
+
+### Chapter 22 — Data Transfers
+- Data transfers between different classification domains must use approved methods
+- All transfers of classified data must be logged
+- Data must be labelled with its protective marking before transfer
+- Key controls: approved transfer mechanisms, transfer logs, label verification procedures