# ISM September 2026 Update: What Changed for Small Business

![TERESEC Security Briefing Special Edition flyer: Patch, the black cat mascot, holds a tablet reading ISM UPDATE beside six plain-English tiles on the September 2026 Information Security Manual changes: AI agent identity, app consent, remote access tools, credentials, caller checks and six-monthly reviews](ism-2026-09-update-flyer.jpg)

Four times a year the Australian Signals Directorate (ASD) updates the Information Security Manual (ISM), its cyber security framework: the standard Australian government agencies follow, and the most complete public description of what "secure" means in this country. The September 2026 release, version 2026.09.4, is a structural one: **44 new controls, 105 amended and two withdrawn**, plus a new chapter, *Guidelines for system access*, gathering the sign-in, credential and session controls that were spread across system hardening and personnel security. Essential Eight maturity markings are unchanged.

No law requires a private small business to follow the ISM. It is still worth ten minutes, because each release says where security expectations are heading, and because six of the 44 new controls describe things a small business, or the IT provider that looks after it, can check this quarter. Those six come first. Every new control, in ASD's own words, is listed at the end.

## Six Things to Check This Quarter

### 1. Your AI agents now need their own ID

**What ASD now says.** An AI agent, meaning software that acts on your behalf (reading mail, filing documents, placing orders) rather than only answering questions, gets its own identity, distinct from any person's account and from other agents ([ISM-2133](/sample-report.html#ISM-2133)). It goes in a register that records its owner and purpose, the identities and credentials it uses, and the tools, permissions and data it can reach ([ISM-2134](/sample-report.html#ISM-2134), [ISM-2135](/sample-report.html#ISM-2135)). Agentic applications are held to the minimum tools and permissions ([ISM-2156](/sample-report.html#ISM-2156)), content they fetch from outside is treated as untrusted ([ISM-2158](/sample-report.html#ISM-2158)), and what they do is logged ([ISM-2159](/sample-report.html#ISM-2159)).

**Does it affect a small business?** If an AI assistant has been connected to your email, files, calendar or accounting software, yes. That is an agent, whatever the product calls it.

**One action.** Write the list: every agent or assistant with access to business systems, who owns it, and what it can reach. If nobody can write that list, that is the finding.

### 2. App consent is admin-only

**What ASD now says.** Staff can no longer grant a third-party application access to the organisation's accounts themselves; an authorised administrator does it ([ISM-2137](/sample-report.html#ISM-2137)). Those consents are reviewed at least every six months, with unused applications and excessive permissions revoked ([ISM-2138](/sample-report.html#ISM-2138)), and the "device code" sign-in flow is switched off unless it is needed ([ISM-2140](/sample-report.html#ISM-2140)). The mechanism is OAuth, the "sign in with your work account" prompt that lets one application act inside another.

**Does it affect a small business?** Any business on Microsoft 365 or Google Workspace. An application a staff member approved with one click keeps its access after that person's password changes, which is why the approval belongs with an administrator.

**One action.** In your tenant's admin settings, turn off user consent for third-party applications, then review what has already been granted.

### 3. Remote access tools go on an allow-list

**What ASD now says.** Keep a list of the remote monitoring and management (RMM) and remote access tools you actually use, enforce it ([ISM-2149](/sample-report.html#ISM-2149)), and block every other one at the gateway ([ISM-2150](/sample-report.html#ISM-2150)). A service provider's access is limited to the tools, source addresses and time windows you approved ([ISM-2124](/sample-report.html#ISM-2124)) and logged somewhere the provider cannot edit ([ISM-2125](/sample-report.html#ISM-2125)).

**Does it affect a small business?** Every business with an IT provider. Your provider's remote tool is legitimate; a second one nobody approved is how intruders stay comfortable.

**One action.** Ask your provider which remote tools they use and from where, write it down, and block the rest.

### 4. Passwords in scripts are out

**What ASD now says.** Applications and services use short-lived, dynamically issued credentials in preference to fixed ones ([ISM-2141](/sample-report.html#ISM-2141)). Fixed credentials are kept in a central secrets manager ([ISM-2142](/sample-report.html#ISM-2142)), are unique to each application and environment ([ISM-2143](/sample-report.html#ISM-2143)), are changed the moment they leak or are found stored in the clear ([ISM-2144](/sample-report.html#ISM-2144)), and are revoked when no longer needed ([ISM-2146](/sample-report.html#ISM-2146)).

**Does it affect a small business?** Any business whose systems talk to each other: a website and a payment gateway, a backup job, a line-of-business application and its database.

**One action.** Find the passwords and keys your systems use among themselves. Any one that is shared, or lives in a script, needs an owner and a home.

### 5. Verify the caller before you change anything

**What ASD now says.** Before acting on a request to change account details, change banking details or make a payment, staff positively identify the requester through a method agreed in advance or a separate trusted channel ([ISM-2126](/sample-report.html#ISM-2126)). ASD files this under *synthetic impersonation*: voices and video can now be faked convincingly, and lookalike emails always could be.

**Does it affect a small business?** Every business that pays invoices or changes supplier details.

**One action.** Agree a call-back rule, a known number and never the one in the email or the message, and write it into the payments procedure.

### 6. Six months is the new annual

**What ASD now says.** Several amended controls move from once a year to every six months: penetration tests and vulnerability assessments, reviews of high-privilege permissions, and rotation of the Kerberos service-account credentials underneath a Windows domain.

**Does it affect a small business?** The review of who holds administrator rights applies to everyone; the rest applies if you run your own Windows domain or commission testing.

**One action.** Put both dates in the calendar now, six months apart.

## What Else Changed

The remaining new controls are mostly for the people who run infrastructure, and are worth passing to your IT provider: sign-in tokens bound to the device they were issued to, and sessions revoked when credentials are reset or a device falls out of compliance; immutable backups on infrastructure segregated from production, with its own administrator sign-in; network management interfaces reachable only from a separate management network, with device firmware verified against a known-good baseline; threat hunting at least quarterly; software built reproducibly with pinned dependencies; driver signature enforcement and limits on kernel-mode code; and hardening and logging for Microsoft Active Directory Certificate Services.

Of the 105 amended controls, most were reworded to distinguish human users from non-human ones, the AI agents and service accounts the new chapter is about. Two controls are withdrawn: one rescinded, one merged into its neighbour. Both are listed at the end.

## Essential Eight: Unchanged

ASD's Essential Eight maturity markings did not move in this release. If your business measures itself against Maturity Level One, ASD's recommendation for small business, nothing here changes that position.

## See It in a Real Report

Our [sample report](/sample-report.html), generated from our live catalogue for a typical small-business stack, lists every ISM control it counts by identifier, so you can go straight to a line: [ISM-2126](/sample-report.html#ISM-2126) on verifying the caller, [ISM-2137](/sample-report.html#ISM-2137) on application consent, [ISM-2149](/sample-report.html#ISM-2149) on remote tools, [ISM-2133](/sample-report.html#ISM-2133) on agent identity. "Reached" and "not reached" there describe the sample stack, not yours.

To see which of these your own licences already reach, [run the free coverage check](https://check.teresec.com.au/?utm_source=teresec.com.au&utm_medium=blog&utm_campaign=ism-2026-09): about three minutes, no sign-up to start. Our control mapping was reviewed against every one of the 151 changes within days of the release, so the check reads your selection against ISM 2026.09.4.

Somebody had to read all 151 changes and work out which ones a business actually has to do something about. Every line above is ASD-public fact, so use it: paste it into your newsletter, read it out in a client meeting, lift a paragraph for a board pack. The [flyer](/content/blog/images/ism-2026-09-update-flyer.jpg) is the same six changes on one page; the price is our logo in the corner.

## The 44 New Controls, in ASD's Words

ASD's wording, unedited, with ASD's chapter and section names. A control the sample report counts links to its line there.

### Procurement and outsourcing (2)

- [ISM-2124](/sample-report.html#ISM-2124) · *Access to systems by service providers.* Access by a service provider to an organisation’s systems is restricted to remote management tools, source network addresses and time windows explicitly approved by the organisation.
- [ISM-2125](/sample-report.html#ISM-2125) · *Access to systems by service providers.* All access to an organisation’s systems by a service provider is independently logged by the organisation in a manner that the service provider cannot modify or delete, and analysed in a timely manner to detect any anomalous, unexpected or unauthorised activity.

### Personnel security (1)

- [ISM-2126](/sample-report.html#ISM-2126) · *Synthetic impersonation.* Personnel positively identify requestors using a pre-established authentication method or independent trusted communication channel before actioning requests to modify user account details, modify banking details or conduct financial transactions.

### System hardening (6)

- [ISM-2127](/sample-report.html#ISM-2127) · *Hardening operating system configurations.* Digital signature verification functionality for drivers is enforced before they are loaded.
- [ISM-2128](/sample-report.html#ISM-2128) · *Hardening operating system configurations.* The ability to install, load or modify kernel-mode code, including drivers, kernel modules and extensions, is limited to privileged users who require such abilities as part of their duties or functions.
- [ISM-2129](/sample-report.html#ISM-2129) · *Windows Management Instrumentation.* WMI activity, including the creation of permanent event subscriptions, is centrally logged.
- [ISM-2130](/sample-report.html#ISM-2130) · *Microsoft Active Directory Certificate Services.* Web-based enrolment interfaces for Microsoft AD CS servers are disabled unless required, and where enabled, are configured to require HTTPS and Extended Protection for Authentication.
- [ISM-2131](/sample-report.html#ISM-2131) · *Microsoft Active Directory Certificate Services.* Certificate templates are reviewed at least every three months to identify and remediate misconfigurations that could enable privilege escalation or unauthorised certificate enrolment.
- [ISM-2132](/sample-report.html#ISM-2132) · *Microsoft Active Directory Certificate Services.* Certificate enrolment events, including successful and unsuccessful requests and changes to certificate templates or Microsoft AD CS configurations, are centrally logged.

### System access (16)

- [ISM-2133](/sample-report.html#ISM-2133) · *Artificial intelligence agent identification.* Each AI agent is assigned a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents.
- [ISM-2134](/sample-report.html#ISM-2134) · *Artificial intelligence agent register.* An AI agent register is developed, implemented, maintained and regularly verified.
- [ISM-2135](/sample-report.html#ISM-2135) · *Artificial intelligence agent register.* An AI agent register contains the following for each AI agent:
  - its unique identifier
  - its owner and business purpose
  - the identities assigned to it
  - any user accounts and credentials it uses
  - the tools, permissions and data repositories it can access.
- [ISM-2136](/sample-report.html#ISM-2136) · *Authenticating to systems.* Risk-based access decisions, informed by contextual signals, are enforced for access to systems and their resources.
- [ISM-2137](/sample-report.html#ISM-2137) · *Third-party application access and device code authentication.* Human users are prevented from granting consent to third-party OAuth applications, with such consent granted only by an authorised administrator.
- [ISM-2138](/sample-report.html#ISM-2138) · *Third-party application access and device code authentication.* OAuth application consents, including their granted permissions, are reviewed at least every six months, with unused applications and excessive permissions revoked.
- [ISM-2139](/sample-report.html#ISM-2139) · *Third-party application access and device code authentication.* Consent grants, token issuance and token use for third-party OAuth applications are centrally logged.
- [ISM-2140](/sample-report.html#ISM-2140) · *Third-party application access and device code authentication.* The OAuth device code authentication flow is disabled unless required, and where required, is restricted to authorised user accounts and managed devices.
- [ISM-2141](/sample-report.html#ISM-2141) · *Application and workload credentials.* Applications and workloads use short-lived dynamically issued credentials in preference to long-lived static credentials.
- [ISM-2142](/sample-report.html#ISM-2142) · *Application and workload credentials.* Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution.
- [ISM-2143](/sample-report.html#ISM-2143) · *Application and workload credentials.* Applications and workloads use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments.
- [ISM-2144](/sample-report.html#ISM-2144) · *Changing credentials.* Static credentials used by applications and workloads are changed if:
  - they are compromised or suspected of being compromised
  - they are discovered stored on systems in the clear
  - they are discovered being transferred across networks in the clear.
- [ISM-2145](/sample-report.html#ISM-2145) · *Revoking credentials.* Credentials for user accounts are revoked when they are no longer required.
- [ISM-2146](/sample-report.html#ISM-2146) · *Revoking credentials.* Static credentials used by applications and workloads are revoked when they are no longer required.
- [ISM-2147](/sample-report.html#ISM-2147) · *Protecting authentication artefacts.* Authentication tokens, session cookies and refresh tokens are cryptographically bound to the device on which they were issued.
- [ISM-2148](/sample-report.html#ISM-2148) · *Protecting authentication artefacts.* Active sessions, refresh tokens and other authentication artefacts are revoked when credentials are reset or re-enrolled, when credentials are compromised or suspected of being compromised, when a device no longer meets compliance requirements, or when high-risk sign-in activity is detected.

### System management (4)

- [ISM-2149](/sample-report.html#ISM-2149) · *Administrative tools.* A list of authorised RMM tools and remote access tools is developed, enforced and maintained.
- [ISM-2150](/sample-report.html#ISM-2150) · *Administrative tools.* Network connections for unauthorised RMM tools and remote access tools are blocked at gateways.
- [ISM-2151](/sample-report.html#ISM-2151) · *Backup modification and deletion.* Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period.
- [ISM-2152](/sample-report.html#ISM-2152) · *Backup modification and deletion.* Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access.

### Security assurance (1)

- [ISM-2153](/sample-report.html#ISM-2153) · *Threat hunting.* Threat hunting activities, informed by current strategic and sector-specific cyber threat intelligence, are conducted at least every three months.

### Software development (6)

- [ISM-2154](/sample-report.html#ISM-2154) · *Software artefacts.* Software artefact dependencies are pinned to approved versions in source code.
- [ISM-2155](/sample-report.html#ISM-2155) · *Build solution.* Software is built using reproducible build practices that enable independent verification that release artefacts were produced from the stated source code.
- [ISM-2156](/sample-report.html#ISM-2156) · *Excessive agency.* Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose.
- [ISM-2157](/sample-report.html#ISM-2157) · *Excessive agency.* Tools invoked by agentic AI applications are subject to both the access controls of the invoking user and agent-specific, task-scoped authorisation, with effective permissions limited to the minimum permitted by both.
- [ISM-2158](/sample-report.html#ISM-2158) · *Excessive agency.* External content retrieved by agentic AI applications is treated as untrusted data throughout processing, is clearly delimited from system instructions, is subject to validation and sanitisation measures applied to other untrusted input, remains untrusted following such processing, and is prevented from modifying or overriding system instructions, security policies, access controls, tool permissions or human approval requirements.
- [ISM-2159](/sample-report.html#ISM-2159) · *Excessive agency.* All tool invocations, external requests and outputs generated by agentic AI applications are centrally logged with sufficient detail to support cyber security incident investigations.

### Networking (8)

- [ISM-2160](/sample-report.html#ISM-2160) · *Networked management interfaces.* Networked management interfaces for IT equipment are only accessible from a dedicated management network that is segregated from the wider network and the internet.
- [ISM-2161](/sample-report.html#ISM-2161) · *Network device integrity.* The integrity of network device firmware and running configurations is verified against an approved known-good baseline following patching, on detection of anomalous behaviour and at least monthly.
- [ISM-2162](/sample-report.html#ISM-2162) · *Network device hardening.* Unneeded components, services and functionality of network devices are disabled or removed.
- [ISM-2163](/sample-report.html#ISM-2163) · *Media Access Control Security.* When using MACsec, confidentiality protection mode is enabled using GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256, preferably GCM-AES-256 or GCM-AES-XPN-256.
- [ISM-2164](/sample-report.html#ISM-2164) · *Media Access Control Security.* A connectivity association lifetime of less than 24 hours (86400 seconds) is used for MACsec connections.
- [ISM-2165](/sample-report.html#ISM-2165) · *Media Access Control Security.* When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required.
- [ISM-2166](/sample-report.html#ISM-2166) · *Media Access Control Security.* A secure association lifetime of less than four hours (14400 seconds) is used for MACsec connections.
- [ISM-2167](/sample-report.html#ISM-2167) · *Media Access Control Security.* The use of a Pre-Shared Key as a fallback authentication method for MACsec is disabled.

## The 2 Withdrawn Controls

- **ISM-0521** · *Networking › Using Internet Protocol version 6.* IPv6 functionality is disabled in dual-stack network devices unless it is being used.
- **ISM-1448** · *Cryptography › Configuring Transport Layer Security.* When using DH or ECDH for key establishment of TLS connections, the ephemeral variant is used.

## Sources

- ASD, [Information security manual](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism): the framework, free and public.
- ASD, [ISM September 2026 changes](https://www.cyber.gov.au/sites/default/files/2026-08/ISM%20September%202026%20changes%20%28September%202026%29.pdf) (PDF): every change in ASD's own words, and the source of truth if wording drifts.
- ASD, [ism-oscal release v2026.09.4](https://github.com/AustralianCyberSecurityCentre/ism-oscal/releases) on GitHub: the machine-readable manual this post was checked against.

*ISM content © Commonwealth of Australia, [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), via cyber.gov.au.*