---
name: ISM Control Pack
description: Read-only audit that maps your Microsoft 365 tenant to ASD ISM controls and builds a control-by-control evidence pack.
---

# ISM Control Pack

> **TL;DR:** This skill inspects your Microsoft 365 tenant read-only and produces an evidence pack that maps each relevant configuration to an ASD Information Security Manual control, with a maturity-aligned risk score.

## How the ISM Control Pack maps Microsoft Purview to the ASD ISM

The Australian Signals Directorate (ASD) Information Security Manual (ISM) defines hundreds of controls that government and regulated organisations are expected to evidence. This skill reads signals from Microsoft Purview, Microsoft Entra ID, Microsoft Defender XDR, Exchange Online and Microsoft Intune, then aligns each one to the matching ISM control and its Essential Eight maturity level. The result is a structured, auditor-ready evidence pack rather than a one-off score.

## When should you run this skill?

- "Build me an ISM control evidence pack for our tenant before the IRAP assessment."
- "Which ISM controls are we already meeting in Microsoft 365 and which are gaps?"
- "Map our Microsoft Purview and Defender configuration to the ASD ISM controls."
- "Show me ISM Essential Eight maturity evidence for patching and application control."
- "We have an audit next month and need a control-by-control compliance snapshot."
- "Give me a read-only ISM posture report I can hand to our assessor."
- "Has anything drifted since our last ISM control review?"

## How this skill works, step by step

1. Authenticate read-only to Microsoft Graph and the relevant Microsoft 365 admin surfaces using least-privilege reviewer roles.
2. Enumerate the in-scope workloads: Microsoft Entra ID, Microsoft Purview, Microsoft Defender XDR, Exchange Online, Microsoft Teams and Microsoft Intune.
3. Collect read-only configuration signals such as conditional access policies, audit log status, retention and DLP policies, patch and vulnerability posture, and application control settings.
4. Normalise each signal and match it to the corresponding ISM control identifier and Essential Eight mitigation strategy.
5. Compare the observed configuration against the expected control state for each Essential Eight maturity level.
6. Assign a per-control status of Met, Partially met or Not met, with the evidence source recorded for each.
7. Derive a tenant risk score by weighting unmet and partially met controls against their maturity level, so higher-maturity gaps raise the score more.
8. Flag process-only controls that cannot be evidenced from technology alone and route them to documentation artefacts.
9. Output the consolidated control-by-control evidence pack with a summary roll-up.

## Output format

The skill returns one row per assessed ISM control, followed by a roll-up summary.

| ISM control | Maturity level | Control summary | Evidence source | Status |
| --- | --- | --- | --- | --- |
| ISM-1877 | 1, 2, 3 | Critical OS patches on internet-facing servers applied within 48 hours. | Microsoft Defender Vulnerability Management | Met |
| ISM-1660 | 2, 3 | Allowed and blocked application control events are centrally logged. | Microsoft Sentinel and Microsoft Defender XDR | Partially met |

Summary roll-up:

- Total ISM controls assessed and how many were Met, Partially met or Not met.
- Tenant risk score and the maturity level it currently supports.
- Top gaps ranked by maturity weight.
- Process-only controls routed to documentation artefacts.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Audit log and retention evidence in Microsoft Purview | Microsoft 365 E3 |
| Conditional access and sign-in evidence | Microsoft Entra ID P1 |
| Vulnerability and patch posture evidence | Microsoft Defender for Endpoint Plan 2 |
| Centralised event log analysis evidence | Microsoft Sentinel |

### Least-privilege roles

- Global Reader
- Security Reader
- Compliance Administrator (read-only review of Microsoft Purview)

### Microsoft Graph permissions (read-only)

- `Policy.Read.All` — reads conditional access and authentication policies for access-control ISM controls.
- `AuditLog.Read.All` — reads sign-in and audit log configuration evidence.
- `DeviceManagementConfiguration.Read.All` — reads Microsoft Intune configuration and hardening profiles.
- `SecurityEvents.Read.All` — reads Microsoft Defender security posture signals.
- Vulnerability and patch posture is read from Microsoft Defender Vulnerability Management, and some Microsoft Purview retention and DLP evidence is reviewed via the Microsoft Purview portal or the Security and Compliance PowerShell module rather than Microsoft Graph.

## Scope and safety

This skill is read-only by default and makes no changes to tenant configuration.

This skill does NOT:

- Modify, create or delete any policy, label or configuration.
- Remediate gaps or apply recommended controls automatically.
- Access mailbox, file or message content beyond configuration metadata.
- Submit or report findings to ASD on your behalf.

## Sources and compliance

- [ASD Information Security Manual (ISM)](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism)
- [Microsoft Essential Eight overview](https://learn.microsoft.com/en-us/compliance/anz/e8-overview)
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Maps to Essential Eight mitigation strategies including patch applications, patch operating systems and application control, and to their underlying ISM controls.
- Output in Australian English.