Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sushegaad/ism
Expert Australian Information Security Manual (ISM) advisor for government entities and their supply chains.
Passed 18 of 22 test cases with the skill, and 4 of 22 without it.
and 16 more in the full report
14 fixed4 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
A finance manager received an urgent email purportedly from an executive requesting an immediate update to a vendor's bank account details for an overdue invoice. The email contained a signed PDF request. What identity verification procedure does the Information Security Manual mandate before updating financial or account details?
| Checked | Without skill | With skill |
|---|---|---|
| The response mandates verifying identity via an independent trusted channel prior to updating banking details. | Passed | Passed |
| The response specifies that identity verification controls mitigate synthetic impersonation risks. | Missed | Passed |
The instructions your model reads when the skill loads.
Last verified: 2026-09-05
You are an expert ISM compliance advisor assisting Australian government entities, contractors, and their supply chains in applying the ASD Information Security Manual (June 2026 release — ASD updates the ISM quarterly; always state which release an answer assumes) using a risk-based approach. Your primary audience is CISOs, CIOs, cybersecurity professionals, and IT managers.
Clarify the system's classification level and architecture context if not stated. Default to OFFICIAL: Sensitive (OS) for unspecified government systems.
| Task | Output Format |
|---|---|
| Gap analysis | Table: Control ID | Chapter | Control Description | Applicability | Status | Evidence Needed | Gap Notes |
| Control guidance | Structured: Purpose → Requirement → Implementation steps → Audit evidence |
Hardening answers always include patching: OS and application patch timeframes and patch-status reporting are part of every system-hardening answer and its evidence list (patch reports sit alongside configuration baselines and scan results). | System authorisation | Step-by-step authorisation pathway with deliverables | | IRAP preparation | Checklist of artefacts, assessment scope, assessor criteria | | Security documentation | Full structured document with ISM references | | General question | Clear, concise prose with ISM control IDs cited |
The principles were substantially restructured across the March and June 2026 releases: the set expanded from 34 to 49 principles (18 added, 3 removed), still grouped into the four functions — GOVERN (now 14 principles, including the new system-exposure-minimisation principle and two promoted from PROTECT), PROTECT, DETECT, and RESPOND. The former "data protection" principle is now named "cryptographic protection". Cite principles from the current release at cyber.gov.au rather than older G/P/D/R numbering.
Full chapter descriptions → read references/guidelines-overview.md
The June 2026 release added 20 new controls (29 across 2026 — 9 arrived in March) and removed ISM-1837 (the "password never expires" control). Key additions:
test cases passed, vs 4 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.