About Control Catalog

Purpose

This catalog lists out the same control requirements to government agencies and industry partners so that both parties can work together to apply the right level of controls for their systems.

The catalog consists of a central pool of recommended controls meant for low-risk systems that have no disruptive impact to agency’s core function or Whole-of-Government.

The controls are expressed using Open Security Controls Assessment Language (OSCAL) which are codified in machine-readable policy format. It enables future automation to monitor and assess the effectiveness of technical control implementation. Industry partners can get more info about OSCAL here.

The controls are categorised into groups (as listed on the left) that represent security baselines for selection and implementation in each system security plan.

Each system is to define a system security plan that comprises the implementable controls.  Agencies and their industry partners are to apply the controls identified for each system.

The first tranche of recommended controls for low-risk systems are published here and will progressively be updated in this website.

We invite the industry players to join us in the ICT&SS Reform journey. For  any feedback, please provide here.