25 KiB
25 KiB
Annex A — ISM Control Cross-Reference & Residual Risk Register
Protective marking:
OFFICIAL: Sensitive(inherits the parent SSP marking; set per system classification).Companion to: System Security Plan. Read the SSP first for system description, boundary and roles.
A&A framework: ASD Information Security Manual (ISM) — engagement target May 2026 release.
Annex version: 0.2 (updated 2026-06-22). v0.2 reflects: STIG hardening applied + bench-verified, USBGuard device control enabled, admin
staff_uconfinement, audit offload verified, PXE/iPXE boot path added, and UEFI Secure Boot signing verified enforcing on real hardware (VM HTTP + 820 PXE) — R-13 reduced from Medium to Low (residual is making signed + SB-on the standing default); and (2026-06-27) a Wazuh SIEM (dedicated multi-node, agentless) now decodes + alerts on the fleet auditd stream — "event log analysis/alerting" moves Planned → Implemented, R-07 reduced toward Low (residual = TLS transport + retention).
How to read this annex
This annex does two things:
- §2 — ISM control cross-reference: maps the ISM control set (by guideline chapter) to how this system implements it, with an implementation status and a pointer to any residual risk.
- §3 — Residual risk register: the consolidated, rated list of residual
risks (
R-NN), each with ISM linkage, compensating controls, treatment and owner. This is the artifact the Authorising Officer reasons over.
⚠ Control-identifier currency caveat
The ISM-NNNN identifiers below are representative and were drafted against
an understanding of the ISM to a January 2026 baseline. The ISM is reissued
quarterly and renumbers/adds/retires controls between releases. Before this
annex is relied upon for assessment, the IRAP assessor MUST reconcile every
identifier against the actual May 2026 ISM, confirm no newly-introduced
controls are unmapped, and confirm none of the cited controls were retired. Where
an exact number is uncertain it is shown as ISM-NNNN* (asterisk = verify
number). The control intent and the system's implementation are the durable
content here; the numbers are a convenience for the assessor.
Status legend
| Status | Meaning |
|---|---|
| Implemented | Control is in place and operating in the current build. |
| Partial | Implemented but incomplete, or scoped to lab config. |
| Planned | On the roadmap / POA&M; not yet implemented. |
| N/A (justified) | Structurally not applicable to a diskless/UKI/immutable design; compensating control noted. |
| Waived | Deliberately not met; documented in the STIG deviation register and/or a residual risk here. |
Risk rating scale
Likelihood × Consequence → Low / Medium / High / Critical (qualitative, ISM/PSPF style). Ratings are pre-treatment unless stated; the AO accepts the post-treatment residual.
2. ISM control cross-reference
2.1 Guidelines for Security Documentation
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| System Security Plan | ISM-0041* | An SSP is developed and maintained. | This document set (SSP + this annex). | Partial | Formal sign-off, role appointment pending. |
| Incident Response Plan | ISM-0043* | An IRP is developed, maintained, exercised. | Not yet authored; inherent recovery via reboot/redeploy. | Planned | R-12 |
| Continuous monitoring plan | ISM-1163* | Continuous monitoring strategy documented. | auditd + centralised offload + Wazuh SIEM (analysis/alerting) exist; formal monitoring plan/runbook not yet documented. | Partial | R-07 |
| Strategies maintained & approved | ISM-0027* | Documentation approved by the authorising authority. | Pending AO appointment & approval. | Planned | — |
2.2 Guidelines for Cyber Security Roles
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| CISO / system owner appointed | ISM-0714*, ISM-1071* | Defined accountable security roles. | Roles identified in [SSP §3]; appointments TBA. | Planned | — |
| System-specific security roles | ISM-1525* | Administrators with defined responsibilities. | Platform team operates build/release & runtime. | Partial | R-05 |
2.3 Guidelines for System Hardening — Operating systems & applications
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Hardened OS to ASD/vendor guidance | ISM-1407*, ISM-1408* | Apply a recognised hardening baseline. | DISA STIG (SSG profile_stig, RHEL 9) via oscap --remediate + documented tailoring + per-build deviations report (stig-deviations.md); applied + bench-verified 2026-06-20, all REVIEW rows triaged. |
Partial | R-03 (CI must ship enable_stig=true + signed/SB-on) |
| Application control / allow-listing | ISM-0843*, ISM-1490*, ISM-1657* | Only approved executables run. | fapolicyd (RPM-trust + two trusted local binaries: kiosk-session, fleet-sb-enroll) + immutable dm-verity root. | Implemented | — |
| Device / removable-media control | ISM-0341*, ISM-1551* | Control USB / peripheral devices. | USBGuard enforcing (ImplicitPolicyTarget=block + hardware-independent HID/hub allowlist + LinuxAudit). Verified: USB mass storage blocked, console input preserved. |
Implemented | — |
| Software / OS integrity | ISM-1493* | Detect unauthorised modification. | dm-verity continuous block-level verification of the read-only root against a signed hash; reproducible build. | Implemented | — |
| Disable unneeded functionality | ISM-0380*, ISM-1416* | Minimise installed software/services. | @^minimal install; scanner tooling removed post-scan; FROM-scratch artifact image; kiosk = single app. |
Implemented | — |
| Hardened user applications (browser) | ISM-1486*, ISM-1412* | Lock down high-risk apps. | Chromium enterprise lockdown policy; weston kiosk; no shell/nav/plugins. | Implemented | — |
| Memory/exploit mitigations | ISM-1341*, ISM-1342* | Enable platform exploit mitigations. | UKI cmdline: slub_debug=P, page_poison=1, init_on_alloc/free=1, vsyscall=none. |
Implemented | — |
| Mandatory access control | ISM-1416* | MAC enforced. | SELinux enforcing; labels preserved into erofs (asserted at build). | Implemented | — |
| Host-based intrusion prevention / file integrity (AIDE) | ISM-1288* | File integrity monitoring. | N/A — superseded by dm-verity (read-only, signed, continuous). | N/A (justified) | — |
| Antivirus / endpoint scanning | ISM-1417* | Malware protection on endpoints. | N/A/compensated — immutable verified root + allow-listing means no persistent writable executable surface; overlay is RAM-only, discarded each boot. | N/A (justified) | — |
2.4 Guidelines for System Hardening — Authentication
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Strong machine authentication | ISM-1546*, ISM-0974* | Mutual, certificate-based auth. | 802.1X EAP-TLS, client key non-exportable in TPM (0x81010001), cert in TPM NV. |
Partial | R-01 (not bench-verified; disabled in test builds), R-08 (placeholder CA) |
| Privileged access restricted | ISM-1507*, ISM-0445* | Limit & control admin access. | Single key-only wheel admin; root login disabled; admin confined to staff_u with a sudo sysadm_r/sysadm_t role/type transition (SELinux context elevates on privilege use). |
Partial | R-05 |
| Secure remote administration | ISM-1506*, ISM-1232* | Hardened admin channel. | SSH key-only, password & keyboard-interactive off, hardened ciphers/MACs/KEX (STIG crypto policy; ECDSA/RSA keys — ed25519 excluded by policy). | Implemented | — |
| No default/shared credentials | ISM-1304* | No baked credentials. | No per-host secrets in any artifact; identity from TPM at runtime; machine-id empty; host keys regenerated at first boot. |
Implemented | — |
| MFA for privileged users | ISM-1173*, ISM-1504* | MFA on privileged access. | Machine auth is cert+TPM (strong). Human admin MFA on the management plane not yet enforced. | Partial | R-05 |
| Passwordless appliance accounts | — (STIG #10) | Account lockout/aging. | kiosk/fleetadmin are key-only; password aging/faillock exempted for these two only, full policy system-wide otherwise. |
Implemented | R-05 (folds into rotatable-access roadmap) |
2.5 Guidelines for System Management
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Patching / vulnerability remediation | ISM-1493*, ISM-1144*, ISM-1472* | Timely patching. | Patch = rebuild + re-sign + redeploy a new digest; atomic, uniform fleet update; cadence/SLA to define. | Partial | R-10 (patch SLA undefined) |
| Secure build & change control | ISM-1483* | Controlled, repeatable builds. | Reproducible Packer build in CI; digest-pinned deployment; one commit/release; rollback = revert commit. | Implemented | — |
| Protect build/signing key material | ISM-0501*, ISM-1233* | Protect keys. | Signing keys CI/HSM-held; never in repo or build VM; never logged. | Implemented | — |
| Privileged actions logged | ISM-1509* | Admin actions auditable. | auditd rules capture privileged/admin events. | Implemented | R-07 (offload protection) |
| Disable debug/back-door access | ISM-1491* | No undocumented access paths. | debug_shell=true currently bakes a passwordless root tty (lab debugging). |
Partial | R-02 (must remove before prod) |
2.6 Guidelines for System Monitoring (event logging)
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Centralised event logging | ISM-0988*, ISM-1405* | Logs centrally collected. | audisp-syslog→rsyslog omfwd (disk-assisted queue) → dedicated collector (serving/audit-collector/), which relays to a dedicated multi-node Wazuh SIEM (wazuh1.bitasylum.org). Agentless (no agent/state on hosts, invariant #1). Bench-verified end-to-end 2026-06-20 (collector) + 2026-06-27 (Wazuh). |
Implemented | R-07 (transport/retention) |
| Required events logged | ISM-0582*, ISM-1537* | Log security-relevant events. | STIG auditd rule set; kernel audit=1, audit_backlog_limit=8192. |
Implemented | — |
| Protect logs in transit | ISM-1432*, ISM-0407* | Encrypt/authenticate log transport. | Plaintext on both hops (host→collector, collector→Wazuh across a routed mgmt LAN); rsyslog TLS rules waived (see STIG #6). | Waived (lab) | R-07 |
| Log retention & integrity | ISM-0859*, ISM-1815* | Retain & protect logs. | Per-source-host files on collector; Wazuh indexer available for retention/ISM but archival/retention policy not yet configured. | Planned | R-07 |
| Event log analysis / alerting | ISM-0109*, ISM-1228* | Review logs; alert on incidents. | Wazuh SIEM with a custom fleet-auditd decoder + severity-tiered rules (fleet_audit group; auth, privilege/USER_CMD, SELinux). Decode + alert bench-verified 2026-06-27 (wazuh-logtest + live sudo in the dashboard). Detection content to expand. |
Implemented (content to mature) | R-07 |
2.7 Guidelines for Networking
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Network access control (802.1X) | ISM-0520*, ISM-1182* | Authenticate devices to the network. | 802.1X port-based control; unauthenticated port = no access. | Partial | R-01 |
| Network segmentation | ISM-1181*, ISM-1532* | Segregate & control traffic. | VLAN assignment post-auth; isolated boot LAN; serving stack separated. | Partial | R-09 |
| Host-based firewall | ISM-1416*, ISM-1416a* | Restrict host network exposure. | firewalld disabled (risk to NVMe/TCP & NM during bring-up). | Waived (lab) | R-09 |
| Disable unused network functionality | ISM-1296* | Minimise network services. | Minimal services; no extraneous listeners; kiosk has no inbound. | Implemented | — |
2.8 Guidelines for Communications Infrastructure / Systems
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Link-layer encryption (cable/fabric) | ISM-1187*, ISM-0181* | Protect data on the link. | MACsec on the access link (encryption + integrity), keyed via MKA after EAP. | Partial | R-01 (MKA survival across switch-root not yet bench-verified) |
2.9 Guidelines for Cryptography
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| ASD-Approved Cryptographic Algorithms (AACA) | ISM-0471*, ISM-1446* | Use approved algorithms. | STIG crypto policy (modern ciphers/MACs/KEX); EAP-TLS, MACsec-GCM. Conformance to ISM AACA not formally asserted; FIPS off. | Partial | R-06 |
| ASD-Approved Cryptographic Protocols (AACP) | ISM-1139*, ISM-1453* | Use approved protocols (TLS 1.2+/1.3). | EAP-TLS, NVMe/TCP & log transport currently plaintext on LAN. | Partial | R-04, R-06, R-07 |
| Key protection / non-exportability | ISM-0501*, ISM-1091* | Protect keys in hardware where feasible. | EAP-TLS private key non-exportable in TPM; UKI signing keys in HSM/CI. | Implemented | — |
| Cryptographic equipment / module evaluation | ISM-0467*, ISM-1277* | Use evaluated crypto modules. | TPM 2.0 hardware; module-evaluation status to confirm; FIPS module not enabled. | Partial | R-06 |
2.10 Guidelines for ICT Equipment & Media
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Media sanitisation / no data remanence | ISM-0347*, ISM-1218* | Prevent data remanence. | Diskless — no persistent local media; writable layer is RAM tmpfs, gone at power-off. | Implemented | — |
| Tamper-evidence / boot integrity | ISM-1542*, ISM-0312* | Detect firmware/boot tampering. | Design: UEFI Secure Boot + signed UKI (+ signed iPXE on the PXE path) + immutable signed cmdline + dm-verity; TPM measurements available. Verified enforcing on real hardware (2026-06-22): CI-signed UKI under SB on a VM (HTTP) and signed iPXE→UKI under SB on an 820 (PXE), db enrolled via fleet-sb-enroll. Residual is making signed + SB-on the standing default for all builds/hosts. |
Implemented (default-posture residual) | R-13 (not yet default), R-11 (no remote attestation) |
| Device identification | ISM-1195* | Uniquely identify devices. | Identity derived from TPM cert (hostnqn from cert serial); no spoofable per-host config. | Implemented | — |
2.11 Guidelines for Procurement, Outsourcing & Evaluated Products
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Supply-chain / artifact integrity | ISM-1567*, ISM-1568* | Trustworthy software supply chain. | FROM-scratch OCI artifact; SHA256SUMS; digest-pinned manifest; reproducible build. | Implemented | — |
| Evaluated/ supported products | ISM-0280*, ISM-1467* | Prefer evaluated/vendor-supported. | RHEL/Rocky 9 (vendor-supported); TPM 2.0; evaluation status of crypto to confirm. | Partial | R-06 |
3. Residual risk register
Ratings are pre-treatment → with the post-treatment residual the AO is asked to accept. Treatments map to docs/TODO.md (working POA&M).
| ID | Residual risk | ISM linkage | Likelihood × Consequence → Rating | Existing compensating controls | Treatment (POA&M) | Post-treat. residual | Owner / target |
|---|---|---|---|---|---|---|---|
| R-01 | Secure path (802.1X EAP-TLS + MACsec) implemented but not bench-verified end-to-end; disabled in test builds (disable_dot1x=true). Until verified, devices may attach to an unauthenticated/unencrypted link. |
2.4, 2.7, 2.8 (ISM-1546*, 0520*, 1187*) | Likely × Major → High | Test path on an isolated lab LAN; full auth stack present (dormant); design follows ASD intent. | Full boot-chain bench test (swtpm + hostapd + FreeRADIUS): port Authorized, macsec0 addressed, MKA survives switch-root, NVMe root mounts. Re-enable in CI. |
Low (once verified) | Platform team — before production ATO |
| R-02 | debug_shell=true bakes a passwordless root shell on a tty — an undocumented privileged access path. |
2.5 (ISM-1491*) | Possible × Severe → High | Lab-only; physical access required; isolated environment. | Set debug_shell=false for all non-lab builds; assert absent in CI. |
Low | Platform team — before production |
| R-03 | STIG hardening applied + bench-verified (2026-06-20, all REVIEW rows triaged); residual is ensuring CI ships enable_stig=true for production builds (it was toggled off during bring-up). |
2.3 (ISM-1407*/1408*) | Possible × Moderate → Medium | Tailoring + register + per-build report; SELinux/fapolicyd/USBGuard on; verified on a real hardened build. | Confirm ENABLE_STIG="true" in CI; keep the 0-eval guard; re-run the deviations report on the assessed build. |
Low | Platform team — before assessment |
| R-04 | NVMe/TCP root traffic plaintext on the LAN — exposure of OS content / injection if the segment is compromised. | 2.9 (ISM-1139*/1453*) | Unlikely × Major → Medium | Isolated boot LAN; MACsec on the access link (once R-01 done) protects the first hop; dm-verity makes injected root blocks fail verification (integrity preserved even if confidentiality isn't). | Production: TLS/IPsec for the storage transport, or rely on MACsec end-to-end across the fabric; document the decision. | Low–Medium | Platform/network — production |
| R-05 | NOPASSWD key-only admin; no per-host or rotatable access model; human admin MFA on the mgmt plane not enforced. | 2.4 (ISM-1507*/1173*) | Possible × Moderate → Medium | Single fleet-generic admin, key-only, root disabled, ECDSA/RSA key, now SELinux-confined to staff_u with sudo role/type elevation, fully audited; no interactive password to attack. |
Per-host/rotatable access (SSH CA / config-agent) + admin MFA on the management plane. | Low–Medium | Platform team — roadmap |
| R-06 | FIPS off; ISM AACA/AACP conformance not formally asserted; crypto-module evaluation status unconfirmed. | 2.9 (ISM-0471*/1139*/1277*) | Possible × Major → Medium | Modern STIG crypto policy; non-exportable TPM key; no deliberately weak algorithms. Acceptable at OFFICIAL; mandatory to resolve for PROTECTED+. | Assert AACA/AACP conformance; decide on FIPS module / evaluated crypto alongside Secure Boot signing. | Low (at appropriate classification) | Security + Platform — before PROTECTED+ |
| R-07 | Audit-log offload plaintext on both hops (host→collector, collector→Wazuh) and log retention/archival not yet configured — logs interceptable in transit and retention/tamper-protection undefined. (SIEM analysis + alerting now in place — Wazuh, decode+alert bench-verified 2026-06-27; transport bench-verified 2026-06-20.) | 2.6 (ISM-1432*/0109*/0859*) | Possible × Moderate → Low–Medium | Isolated/mgmt LAN; disk-assisted queue (no loss on collector/SIEM blip); auditd local copy; per-source files; Wazuh now actively decodes + alerts (fleet_audit). |
rsyslog TLS (gtls/6514) on both hops + bundle CA in image (re-select the 3 waived rsyslog_encrypt_offload_* rules); configure Wazuh retention/archival (ISM) + rotate default creds + restrict dashboard/API. |
Low | Platform/SecOps — production |
| R-13 | Boot-chain signing not yet the standing default — signing + Secure Boot enforcement are verified end-to-end on real hardware (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22, SB enforcing, db enrolled), but unsigned/SB-OFF lab builds remain possible (CI signs only when SB_KEY/SB_CERT are set) and not every host has db enrolled, so a substituted artifact could still boot on an un-enrolled/unsigned host. |
2.10 (ISM-1542*/0312*) | Unlikely × Major → Low | Capability proven on hardware; dm-verity rejects a tampered root regardless; isolated lab LAN. | Make signed + Secure-Boot-on the default for all production builds/hosts: keep SB_KEY/SB_CERT CI secrets set; enrol db fleet-wide; treat an unsigned build as lab-only. |
Low | Platform team — before production |
| R-08 | Placeholder RADIUS CA (files/etc/dot1x/radius-ca.pem) — real EAP-TLS trust anchor not provisioned; auth cannot succeed and trust is unestablished. |
2.4 (ISM-1546*) | Certain (lab) × Major → Medium | Documented as a placeholder; environment-specific provisioning is the intended path; no real CA committed. | Provision the environment's real RADIUS CA out-of-band (not committed unless classification permits). | Low | Environment owner — before production |
| R-09 | Host firewall disabled; host exposes more network surface than necessary. | 2.7 (ISM-1416*) | Possible × Moderate → Low–Medium | Isolated LAN; minimal services; egress controlled at the network/serving layer; no kiosk inbound. | Re-enable firewalld with explicit allow rules (NVMe/TCP :4420, DHCP, log offload, SSH) once the secure path is verified. |
Low | Platform/network — after R-01 |
| R-10 | Patch SLA undefined — no documented cadence for rebuilding/redeploying against new CVEs. | 2.5 (ISM-1144*/1472*) | Likely × Moderate → Medium | Atomic rebuild/redeploy model makes patching fast & uniform; reproducible builds. | Define patch cadence & critical-CVE SLA; automate rebuild triggers. | Low | Platform team — roadmap |
| R-11 | No remote attestation of TPM boot measurements — a compromised boot can't be detected centrally. | 2.10 (ISM-1542*) | Unlikely × Major → Low–Medium | Secure Boot + signed UKI + dm-verity already prevent unsigned/modified boot; measurements exist locally. | Implement remote attestation (TPM quote → verifier) gating network/storage access. | Low | Platform team — roadmap |
| R-12 | No formal Incident Response Plan; volatile RAM overlay complicates live forensics. | 2.1, 2.6 (ISM-0043*/0109*) | Possible × Moderate → Medium | Inherent recovery (reboot → verified state; revert digest); centralised logs survive host wipe. | Author IRP + log-retention + break-glass/forensics procedure suited to stateless hosts. | Low | SecOps — before production |
3.1 Risk heatmap (post-treatment targets)
Consequence → Minor Moderate Major Severe
Likelihood ↓
Certain
Likely R-10 R-01*
Possible R-05 R-07 R-03 R-02*
R-12 R-06 R-08
Unlikely R-04
R-11 R-09
Rare
( * = currently High pre-treatment; all targeted to Low after treatment )
The heatmap shows pre-treatment positions; every item has a treatment to Low /
Low–Medium. The AO is asked to authorise on the basis that R-01, R-02, R-08,
R-12 and R-13 (and confirming R-03's enable_stig=true) are closed before
production, and R-04/R-05/R-06/R-07/R-09/R-10/R-11 are either accepted with
compensating controls (isolated-LAN lab) or carried on the POA&M with target
dates. Newly strengthened in v0.2: device control (USBGuard, now Implemented),
admin SELinux confinement (R-05), STIG applied+verified (R-03 reduced), and
Secure Boot signing verified enforcing on real hardware (R-13 reduced
Medium→Low).
4. Assessor notes / open items for the IRAP assessment
- Reconcile all
ISM-NNNN*identifiers against the May 2026 ISM (see currency caveat) and confirm no new controls are unmapped. - Confirm the system data classification with the System Owner — it sets the required control baseline and may reclassify several "N/A/accepted" items (notably R-06 cryptography) as mandatory.
- Witness the secure-path bench test (R-01) — this is the central effectiveness check; the rest of the architecture's value is contingent on it.
- Verify reproducibility — two builds → identical
verity.jsonroot hash (build-integrity control evidence). - Review the STIG generated report for the build under assessment — every non-pass rule should map to the deviation register; anything flagged REVIEW is an unjustified finding.
- Confirm lab-only flags are off in the assessed build:
debug_shell=false,enable_stig=true,disable_dot1x=false, real RADIUS CA in place. - Confirm boot-chain signing is the default (R-13): signing + Secure Boot
enforcement are verified on hardware (VM HTTP + 820 PXE, 2026-06-22) —
confirm the assessed build is signed and the assessed hosts have
dbenrolled with Secure Boot ON (mokutil --sb-state,sbverifyUKI + iPXE). The PXE/iPXE SB-OFF cmdline workaround is a no-op once SB is on. - Witness device control (USBGuard): a USB mass-storage device is blocked and logged, console HID still works.
End of Annex A.