ASD Information security manual (ISM)

Version 2026.09.4. The framework. A check that names a requirement in its Control attribute supports it; it does not make the tenant compliant.

15 requirements have a Maester check, with 14 checks in all. Only those are listed.

Run theseInvoke-Maester -Suite asd

Guidelines for system access7 of 7

ISM-0445Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. ASD.ISM-1175Has a check

ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. ASD.ISM-1175Has a check

ISM-1403User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts. ASD.ISM-1403Has a check

ISM-1504Multi-factor authentication is used to authenticate human users to their organisation's online services. ASD.ISM-1504Has a check

ISM-1648Privileged access to systems and their resources is disabled after 45 days of inactivity. ASD.ISM-1648Has a check

ISM-1649Just-in-time administration is used for the administration of systems and their resources. ASD.ISM-1649Has a check

ISM-1872Multi-factor authentication used for authenticating human users of online services is phishing-resistant. ASD.ISM-1872Has a check

Guidelines for system hardening7 of 7

ISM-1488Microsoft Office macros in files originating from the internet are blocked. ASD.ISM-1488Has a check

ISM-1654Internet Explorer 11 is disabled or removed. ASD.ISM-1654Has a check

ISM-1667Microsoft Office is blocked from creating child processes. ASD.ISM-1667Has a check

ISM-1668Microsoft Office is blocked from creating executable content. ASD.ISM-1668Has a check

ISM-1669Microsoft Office is blocked from injecting code into other processes. ASD.ISM-1669Has a check

ISM-1672Microsoft Office macro antivirus scanning is enabled. ASD.ISM-1672Has a check

ISM-1673Microsoft Office macros are blocked from making Win32 API calls. ASD.ISM-1673Has a check

Guidelines for system management1 of 1

ISM-1695Patches for vulnerabilities in the operating systems of workstations are applied within one month of release. ASD.ISM-1695Has a check