The standards
What the ISM, the Essentials for Enterprise IT and ASVS are, where each release comes from, and how the Advisor keeps them current.
ASD Information Security Manual (ISM)
The Australian Signals Directorate's manual for protecting government systems. Controls are grouped into baselines by classification (NON_CLASSIFIED through TOP_SECRET) and the Essential Eight maturity levels. The Advisor loads the ISM from ASD's official OSCAL releases, which are published several times a year, and names the release on every answer. Control ids look like ism-1504.
The ISM server also carries an overlay for operational technology: for each relevant control, where it sits against IEC 62443, NIST SP 800-82, the Purdue levels and the ASD principles of operational technology cyber security.
ASD Essentials for Enterprise IT
ASD's replacement for the Essential Eight, published in October 2026. It is organised as principles, actions and domains, and an organisation rates each action per domain as not, partially or fully effective from ASD's indicators of good practice, with the weakest link setting the principle's rating. ASD publishes a crosswalk from each action to the ISM, the Essential Eight, NIST CSF 2.0, SP 800-171r3 and AESCSF, which the Advisor carries. Action ids look like IT.PRO-13.4.
ASD states that Essential Eight maturity ratings do not translate into Essentials effectiveness ratings. The Advisor treats an existing Essential Eight assessment as evidence for an assessor, never as a result.
The Essentials catalogue is bundled with the server, so it answers from a fresh install with no network; newer releases come from cyber.gov.au.
OWASP Application Security Verification Standard (ASVS)
The OWASP standard for verifying the security of web applications and APIs, at three levels of assurance. The Advisor loads ASVS 5 from OWASP's releases. Requirement ids look like V6.2.1. ASVS 5 differs substantially from ASVS 4, which is the version most assistants know from their training, which is why the Advisor never answers from memory.
Keeping current
Each server checks its publisher for a newer release on a schedule and loads it when one appears. The admin console on a deployed container shows when each release was published, when the container loaded it, and when it last checked. An assessment records the release it was made against; if the standard moves while an assessment is in progress, the next walk-through says so and names the recorded controls that changed.
Licences for the content
The ISM is © Commonwealth of Australia, Australian Signals Directorate, under CC BY 4.0. ASVS is © OWASP Foundation, under CC BY-SA 4.0. Generated documents carry the attribution.