---
id: 'ism_o'
title: 'Australian Signals Directorate Information Security Manual'
policy: 'Australian Signals Directorate Information Security Manual'
version: '2024.03'
source: 'https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism'

reference_type: ism

levels:
    - id: base
    - id: secret
      inherits_from:
          - base
    - id: top_secret
      inherits_from:
          - secret

controls:
    - id: '0418'
      title: 'Credentials are kept separate from systems they are used to authenticate to, except for
          when performing authentication activities.'
      levels:
          - base
      rules:
          - accounts_maximum_age_login_defs
          - accounts_minimum_age_login_defs
          - accounts_password_warn_age_login_defs
          - configure_kerberos_crypto_policy
          - configure_ssh_crypto_policy
          - enable_ldap_client
          - kerberos_disable_no_keytab
          - network_nmcli_permissions
          - sebool_kerberos_enabled
          - set_password_hashing_algorithm_libuserconf
          - set_password_hashing_algorithm_logindefs
          - set_password_hashing_algorithm_passwordauth
          - set_password_hashing_algorithm_systemauth
          - sshd_disable_gssapi_auth
          - var_password_hashing_algorithm_pam=yescrypt
      status: automated

    - id: '0421'
      title: 'Passphrases used for single-factor authentication are at least 4 random words with a total
          minimum length of 14 characters, unless more stringent requirements apply.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sshd_max_auth_tries_value=5
          - sssd_enable_smartcards
          - var_password_pam_minlen=14
          - var_accounts_password_minlen_login_defs=14
          - var_accounts_password_warn_age_login_defs=7
          - var_accounts_minimum_age_login_defs=1
          - var_accounts_maximum_age_login_defs=60
          - var_authselect_profile=sssd
      status: automated

    - id: '0422'
      title: 'Passphrases used for single-factor authentication on TOP SECRET systems are at least 6
          random words with a total minimum length of 20 characters.'
      levels:
          - top_secret
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
          - var_password_pam_minlen=20
          - var_accounts_password_minlen_login_defs=20
      status: automated
    - id: '0484'
      title: 'SSH daemon configuration'
      levels:
          - base
      rules:
          - disable_host_auth
          - sshd_enable_warning_banner
          - sshd_disable_x11_forwarding
      status: partial
    - id: '0487'
      title: 'Passwordless SSH Connections Configuration'
      levels:
          - base
      status: pending

    - id: '0582'
      title: 'Central Logging for OS Events'
      levels:
          - base
      rules:
          - audit_access_failed
          - audit_access_failed_aarch64
          - audit_access_failed_ppc64le
          - audit_access_success
          - audit_access_success_aarch64
          - audit_access_success_ppc64le
          - audit_rules_privileged_commands
          - audit_rules_session_events_utmp
          - audit_rules_session_events_btmp
          - audit_rules_session_events_wtmp
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_open_by_handle_at
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_unsuccessful_file_modification_ftruncate
          - package_audit_installed
          - sshd_print_last_log
          - sebool_auditadm_exec_content
          - auditd_log_format
          - auditd_data_retention_flush
          - auditd_local_events
          - auditd_log_format
          - auditd_name_format
          - auditd_write_logs
          - auditd_freq
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_chown
          - audit_rules_execution_chcon
          - audit_rules_execution_restorecon
          - audit_rules_execution_semanage
          - audit_rules_execution_setfiles
          - audit_rules_execution_setsebool
          - audit_rules_execution_seunshare
          - audit_rules_kernel_module_loading
          - audit_rules_login_events_faillock
          - audit_rules_networkconfig_modification
          - audit_rules_sysadmin_actions
          - audit_rules_time_adjtimex
          - audit_rules_time_clock_settime
          - audit_rules_time_settimeofday
          - audit_rules_time_stime
          - audit_rules_time_watch_localtime
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow
          - audit_rules_login_events_tallylog
          - audit_rules_login_events_lastlog
      status: automated

    - id: '0846'
      title: 'All users (with the exception of local administrator accounts and break glass accounts)
          cannot disable, bypass or be exempted from application control.'
      levels:
          - base
      rules:
          - audit_access_failed
          - audit_access_failed_aarch64
          - audit_access_failed_ppc64le
          - audit_access_success
          - audit_access_success_aarch64
          - audit_access_success_ppc64le
          - audit_rules_privileged_commands
          - audit_rules_session_events_utmp
          - audit_rules_session_events_btmp
          - audit_rules_session_events_wtmp
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_open_by_handle_at
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_unsuccessful_file_modification_ftruncate
          - package_audit_installed
          - sshd_print_last_log
          - sebool_auditadm_exec_content
      status: automated

    - id: '0974'
      title: 'Multi-factor authentication is used to authenticate unprivileged users of systems.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: partial
      notes: |-
          This needs reevaluation.

    - id: '0988'
      title: 'An accurate time source is established and used consistently across systems to assist with
          identifying connections between events.'
      levels:
          - base
      rules:
          - chronyd_configure_pool_and_server
          - chronyd_or_ntpd_specify_multiple_servers
          - chronyd_specify_remote_server
          - package_chrony_installed
          - rsyslog_cron_logging
          - rsyslog_files_groupownership
          - rsyslog_files_ownership
          - rsyslog_files_permissions
          - rsyslog_nolisten
          - rsyslog_remote_loghost
          - rsyslog_remote_tls
          - rsyslog_remote_tls_cacert
          - service_chronyd_enabled
          - service_chronyd_or_ntpd_enabled
      status: automated

    - id: '1034'
      title: 'A HIPS is implemented on critical servers and high-value servers.'
      levels:
          - base
      rules:
          - package_aide_installed
      status: automated

    - id: '1055'
      title: 'LAN Manager and NT LAN Manager authentication methods are disabled.'
      levels:
          - base
      rules:
          - accounts_maximum_age_login_defs
          - accounts_minimum_age_login_defs
          - accounts_password_warn_age_login_defs
          - configure_kerberos_crypto_policy
          - enable_ldap_client
          - kerberos_disable_no_keytab
          - network_nmcli_permissions
          - sebool_kerberos_enabled
          - set_password_hashing_algorithm_libuserconf
          - set_password_hashing_algorithm_logindefs
          - set_password_hashing_algorithm_passwordauth
          - set_password_hashing_algorithm_systemauth
          - sshd_disable_gssapi_auth
      status: partial
      notes: |-
          Needs reevaluation

    - id: '1173'
      title: 'Multi-factor authentication is used to authenticate privileged users of systems.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: automated

    - id: '1277'
      title: 'Data communicated between database servers and web servers is encrypted.'
      levels:
          - base
      rules:
          - openssl_use_strong_entropy
      status: partial

    - id: '1288'
      title: 'Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple
          different scanning engines.'
      levels:
          - base
      rules:
          - package_aide_installed
      status: partial

    - id: '1311'
      title: 'SNMP version 1 and SNMP version 2 are not used on networks.'
      levels:
          - base
      rules:
          - service_snmpd_disabled
          - snmpd_use_newer_protocol
      status: partial

    - id: '1315'
      title: 'The administrative interface on wireless access points is disabled for wireless network
          connections.'
      levels:
          - base
      rules:
          - network_ipv6_static_address
          - wireless_disable_interfaces
      status: automated

    - id: '1319'
      title: 'Static addressing is not used for assigning IP addresses on wireless networks.'
      levels:
          - base
      rules:
          - network_ipv6_static_address
          - wireless_disable_interfaces
      status: partial

    - id: '1341'
      title: 'A HIPS is implemented on workstations.'
      levels:
          - base
      rules:
          - package_aide_installed
      status: automated

    - id: '1386'
      title: 'Network management traffic can only originate from administrative infrastructure.'
      levels:
          - base
      rules:
          - configure_opensc_card_drivers
          - force_opensc_card_drivers
          - package_opensc_installed
          - package_pcsc-lite_installed
          - package_pcsc-lite-ccid_installed
          - package_sudo_installed
          - service_pcscd_enabled
      status: partial
      notes: |-
          This needs reevaluation.

    - id: '1401'
      title: 'Multi-factor authentication uses either: something users have and something users know,
          or something users have that is unlocked by something users know or are.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: partial

    - id: '1402'
      title: 'Credentials stored on systems are protected by a password manager; a hardware security
          module; or by salting, hashing and stretching them before storage within a database'
      levels:
          - base
      rules:
          - accounts_maximum_age_login_defs
          - accounts_minimum_age_login_defs
          - accounts_password_warn_age_login_defs
          - configure_kerberos_crypto_policy
          - enable_ldap_client
          - kerberos_disable_no_keytab
          - network_nmcli_permissions
          - sebool_kerberos_enabled
          - set_password_hashing_algorithm_libuserconf
          - set_password_hashing_algorithm_logindefs
          - set_password_hashing_algorithm_passwordauth
          - set_password_hashing_algorithm_systemauth
          - sshd_disable_gssapi_auth
          - accounts_password_all_shadowed
      status: automated

    - id: '1405'
      title: 'A centralised event logging facility is implemented and event logs are sent to the facility
          as soon as possible after they occur.'
      levels:
          - base
      rules:
          - chronyd_configure_pool_and_server
          - chronyd_or_ntpd_specify_multiple_servers
          - chronyd_specify_remote_server
          - package_chrony_installed
          - rsyslog_cron_logging
          - rsyslog_files_groupownership
          - rsyslog_files_ownership
          - rsyslog_files_permissions
          - rsyslog_nolisten
          - rsyslog_remote_loghost
          - rsyslog_remote_tls
          - rsyslog_remote_tls_cacert
          - service_chronyd_enabled
          - service_chronyd_or_ntpd_enabled
      status: automated

    - id: '1409'
      title: 'Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur'
      rules:
          - dir_perms_world_writable_sticky_bits
          - file_ownership_binary_dirs
          - file_ownership_library_dirs
          - file_permissions_binary_dirs
          - file_permissions_library_dirs
          - file_permissions_unauthorized_sgid
          - file_permissions_unauthorized_suid
          - file_permissions_unauthorized_world_writable
          - mount_option_dev_shm_nodev
          - mount_option_dev_shm_noexec
          - mount_option_dev_shm_nosuid
          - network_sniffer_disabled
          - package_fapolicyd_installed
          - package_firewalld_installed
          - package_rsyslog_installed
          - package_squid_removed
          - package_telnet_removed
          - package_telnet-server_removed
          - selinux_policytype
          - selinux_state
          - service_auditd_enabled
          - service_avahi-daemon_disabled
          - service_fapolicyd_enabled
          - service_firewalld_enabled
          - service_rsyslog_enabled
          - service_squid_disabled
          - service_telnet_disabled
          - sshd_enable_strictmodes
          - sshd_set_loglevel_info
          - sshd_use_directory_configuration
          - sysctl_kernel_exec_shield
          - sysctl_kernel_kexec_load_disabled
          - sysctl_kernel_kptr_restrict
          - sysctl_kernel_randomize_va_space
          - sysctl_kernel_unprivileged_bpf_disabled
          - sysctl_kernel_yama_ptrace_scope
          - sysctl_net_core_bpf_jit_harden
          - enable_authselect
          - rpm_verify_hashes
          - rpm_verify_ownership
          - security_patches_up_to_date
          - package_rear_installed
          - rpm_verify_permissions
          - package_ypbind_removed
          - package_ypbind_removed
          - package_xinetd_removed
          - service_xinetd_disabled

    - id: '1416'
      title: 'A software firewall is implemented on workstations and servers to restrict inbound and
          outbound network connections to an organisation-approved set of applications and services.'
      levels:
          - base
      rules:
          - configure_firewalld_ports
          - firewalld_sshd_port_enabled
          - set_firewalld_default_zone
      status: automated

    - id: '1417'
      title: 'Antivirus software is implemented on workstations and server.'
      levels:
          - base
      rules:
          - package_aide_installed
      status: partial

    - id: '1418'
      title: 'If there is no business requirement for reading from removable media and devices, such
          functionality is disabled via the use of device access control software or by disabling external
          communication interfaces'
      levels:
          - base
      rules:
          - package_usbguard_installed
          - service_usbguard_enabled
          - usbguard_allow_hid_and_hub
      status: automated

    - id: '1446'
      title: 'When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.'
      levels:
          - base
      rules:
          - configure_crypto_policy
          - enable_dracut_fips_module
          - system_booted_in_fips_mode
          - var_system_crypto_policy=fips
          - enable_fips_mode
      status: automated

    - id: '1449'
      title: 'SSH private keys are protected with a passphrase or a key encryption key'
      levels:
          - base
      rules:
          - file_permissions_sshd_private_key
      status: partial
      notes: |-
          This needs more

    - id: '1467'
      title: 'The latest release of office productivity suites, web browsers and their extensions, email
          clients, PDF software, and security products are used.'
      levels:
          - base
      rules:
          - dnf-automatic_apply_updates
          - package_libdnf-plugin-subscription-manager_installed
          - package_subscription-manager_installed
      status: automated

    - id: '1483'
      title: 'The latest release of internet-facing server applications are used.'
      levels:
          - base
      rules:
          - dnf-automatic_apply_updates
          - package_libdnf-plugin-subscription-manager_installed
          - package_subscription-manager_installed
          - sshd_allow_only_protocol2
      status: automated

    - id: '1491'
      title: 'Unprivileged users are prevented from running script execution engines.'
      levels:
          - base
      rules:
          - no_shelllogin_for_systemaccounts
      status: automated

    - id: '1493'
      title: 'Software registers for workstations, servers, network devices and other ICT equipment are
          developed, implemented, maintained and verified on a regular basis.'
      levels:
          - base
      rules:
          - dnf-automatic_apply_updates
          - package_libdnf-plugin-subscription-manager_installed
          - package_subscription-manager_installed
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_local_packages
          - ensure_gpgcheck_never_disabled
          - ensure_redhat_gpgkey_installed
          - package_sequoia-sq_installed
          - ensure_oracle_gpgkey_installed
          - dnf-automatic_security_updates_only
      status: automated

    - id: '1504'
      title: 'Multi-factor authentication is used to authenticate users to their organisation’s online
          services that process, store or communicate their organisation’s sensitive data.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: partial

    - id: '1505'
      title: 'Multi-factor authentication is used to authenticate users of data repositories.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: partial

    - id: '1506'
      title: 'The use of SSH version 1 is disabled for SSH connections.'
      levels:
          - base
      related_rules:
          - sshd_allow_only_protocol2
      status: inherently met
      notes: |-
          As of OpenSSH 7.6, OpenSSH only supports SSH 2.

    - id: '1546'
      title: 'Users are authenticated before they are granted access to a system and its resources'
      levels:
          - base
      rules:
          - accounts_no_uid_except_zero
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
          - sshd_disable_empty_passwords
          - sshd_disable_rhosts
          - sshd_disable_root_login
          - sshd_disable_user_known_hosts
          - sshd_do_not_permit_user_env
          - no_empty_passwords
          - sudo_remove_no_authenticate
          - sudo_remove_nopasswd
          - sudo_require_authentication
          - sysctl_kernel_dmesg_restrict
      status: automated

    - id: '1552'
      title: 'All web application content is offered exclusively using HTTPS.'
      levels:
          - base
      rules:
          - openssl_use_strong_entropy
      status: partial

    - id: '1557'
      title: 'Passphrases used for single-factor authentication on SECRET systems are at least 5 random
          words with a total minimum length of 17 characters.'
      levels:
          - secret
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
          - var_password_pam_minlen=17
          - var_accounts_password_minlen_login_defs=17
      status: partial

    - id: '1558'
      title: 'Passphrases used for single-factor authentication are not a list of categorised words;
          do not form a real sentence in a natural language; and are not constructed from song lyrics,
          movies, literature or any other publicly available material.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: automated

    - id: '1559'
      title: 'Memorised secrets used for multi-factor authentication are a minimum of 6 characters, unless
          more stringent requirements apply.'
      levels:
          - base
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: automated

    - id: '1560'
      title: 'Memorised secrets used for multi-factor authentication on SECRET systems are a minimum
          of 8 characters'
      levels:
          - secret
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: automated

    - id: '1561'
      title: 'Memorised secrets used for multi-factor authentication on TOP SECRET systems are a minimum
          of 10 characters.'
      levels:
          - top_secret
      rules:
          - accounts_password_minlen_login_defs
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_minclass
          - accounts_password_pam_minlen
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny_root
          - accounts_passwords_pam_faillock_interval
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - disable_host_auth
          - require_emergency_target_auth
          - require_singleuser_auth
          - sebool_authlogin_nsswitch_use_ldap
          - sebool_authlogin_radius
          - sshd_disable_kerb_auth
          - sshd_set_max_auth_tries
          - sssd_enable_smartcards
      status: automated

    - id: '1745'
      title: 'Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is
          enabled.'
      levels:
          - base
      rules:
          - secure_boot_enabled
      status: manual
