Verification chain
Four things are pinned, and each can be checked independently of the others.
The assessment PDF. SHA-256: a25cc19c8e3bf0173abbe96227ae384dfc8f5f4822ab6dfd2a8da7ea480046d3
Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.
The timestamp. The receipt AOS-ISM-2026-001-v1.2.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 5 September 2026 and pending confirmation in the Bitcoin blockchain at publication. It has since been anchored: the receipt served here carries three Bitcoin attestations. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.
The assessed source. The assessment rests on 14 pinned artefacts, each listed below with its reference, its description as registered and its SHA-256. All 14 are pinned by hash and no row records a third-party capture. Quotations were read from text extracted from the pinned PDFs; the September 2026 chapter’s control count was read from rendered page images; control numbers, revisions and applicability markings were read from the printed control line as the document sets it out.
| Ref | Artefact | SHA-256 | Third-party copy |
|---|---|---|---|
| I-ISM-1 | ISM Guidelines for procurement and outsourcing, June 2026 release. cyber.gov.au page as served, first published and last updated 09 Jun 2026 | 32c8af6a8f467f5a573faa76b93d01005bb4e078b3d4931e6fa0fe3b8c1bffa6 | - |
| I-ISM-2 | ISM Guidelines for procurement and outsourcing (June 2026), PDF chapter, 9 pages, linked from I-ISM-1 | 272cc6cdc11ecce202fe1969dcddefbd31317b40b2b5b27f8e6b8999de978048 | - |
| I-ISM-3 | Information security manual (June 2026), full release, 261 pages, authorised PDF from cyber.gov.au | be2f7c32855ccad55f09c3397e1ea8f79b30907b5a155568c2d8943ef668693f | - |
| I-ISM-4 | ISM June 2026 changes (June 2026), the release change log, 6 pages | 4780b0c27a1faf766f3e117a11bfc2800deb409228ea7f2903cb60f5379ee4b9 | - |
| I-ISM-5 | System security plan annex template (June 2026), the machine-readable list of every control in the release | c7e2f6dc52ae558fd29732adc5faf36f8de404f58248513b179fdd48eecb3d34 | - |
| I-ISM-6 | Information security manual (March 2026), full release ZIP, 27 chapter PDFs, retrieved from the PUBLISHER's archived-releases index (not a third-party copy, not an archive capture) | 10daaaeea199ad69e23daf6ada05165c97aca839392d5bd176c60f72a5cedc3d | - |
| I-ISM-7 | ISM Guidelines for procurement and outsourcing (March 2026), chapter PDF extracted from I-ISM-6, 9 pages, self-identifying 'Last updated: March 2026' | 2fb43141801d0b4145266fa4a7fcb055963b7ccd64587ec5a4fd3234d9f44df7 | - |
| I-ISM-8 | ASD archived ISM releases index, the page that publishes nine prior releases; the discovery source for I-ISM-6 | f4a2410022bdc2719914f56e08b42e4fa43087314d75f8eda77ffbde68e9f43c | - |
| I-ISM-17 | ISM Guidelines for procurement and outsourcing, September 2026 release. cyber.gov.au page as served, first published and last updated 03 Sep 2026 | 66917ad7a551242d64d0fa593b6038866bd697ccb841e883c2cde775268e235e | - |
| I-ISM-18 | ISM Guidelines for procurement and outsourcing (September 2026), PDF chapter, 10 pages, linked from I-ISM-17 | 3ecc83803c0b0f1124cd4fc88b6b7e356d76a1732c6555e73b92d1612948415a | - |
| I-ISM-19 | Information security manual (September 2026), full release, 271 pages, authorised PDF from cyber.gov.au | 048f879e2fbd37636623320778424d92c6f17e5b0a7209432696005dd5a60f8c | - |
| I-ISM-20 | ISM September 2026 changes (September 2026), the release change log, 10 pages | c299a5b6b5f0339f52b8df2a1a4f2510dc1793e96de53b9bff21eebb30a91abf | - |
| I-ISM-21 | System security plan annex template (September 2026), the machine-readable list of every control in the release | 5db3d188bdd70c48a1cbe1e1e93f2760be33e49003565867034da57d0b514664 | - |
| I-ISM-22 | ASD archived ISM releases index, as served 04 Sep 2026, first published and last updated 03 Sep 2026 | 9ff74712ef632c2590ecf5c9a42e28f62402716c6cda257b309beaadead95f6d | - |
No row in this register records a third-party capture. All 14 artefacts above were retrieved from their publisher by this practice and are held in this corpus. That is a statement about what this register holds, not about what exists - no archive index was queried, and an absence here is not evidence of an absence in any archive. A reader who wants to check a quotation against an independent copy must locate one. Until this practice records one, the alternatives are this site and the publisher’s own server.
The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to midnight UTC of 17 August 2026, the publication day, which does not move at any revision. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.
Version history
Three versions. v1.2 withdraws three statements, two of them also in v1.0, narrows one, and re-establishes the finding against the September 2026 release. A revision does not replace its predecessor: every earlier version’s bytes are unchanged, its hash still resolves, and the file remains downloadable at its own address - every version is listed below with its hash and its own address. v1.1 was published 19 August 2026 and v1.2 on 5 September 2026. Every revision keeps v1.0’s SOURCE_DATE_EPOCH, because a revision is not a new reading of the release it assesses - it is the same reading, corrected; the Assessed column records each reading’s date.
| Version | Assessed | Published | SHA-256 | Status |
|---|---|---|---|---|
| v1.0 | 17 August 2026 | 17 August 2026 | ce8351158f83abfc9ee74a4bbd0754d9a189d2012bb09c59f6257349f260f7b2 | superseded, not withdrawn · download |
| v1.1 | 17 August 2026 | 19 August 2026 | 2201d59a8568455ee78ba412250d16967119b04f57d6abe75e928ccc8e960450 | superseded, not withdrawn · download |
| v1.2 | 17 August 2026 | 5 September 2026 | a25cc19c8e3bf0173abbe96227ae384dfc8f5f4822ab6dfd2a8da7ea480046d3 | current · download |
The cover carries 5 September 2026, the date this revision was made. The assessment was first made on 17 August 2026. A revision’s cover carries the revision date while the epoch inside the PDF stays at the first reading’s date, and the version table records each version’s dates.
Corrections
The timestamp sentence named a receipt that did not exist, from publication until 23 August 2026. The page said the receipt AOS-ISM-2026-001-v1.1.pdf.ots was “submitted to four calendars on 19 August 2026” and linked it. No receipt had been created for this version, on that date or any other, and the link returned HTTP 404 to every reader who followed it. The sentence was generated from the page’s publication date and rendered whether or not a receipt existed, so it asserted a stamping it never checked.
What was done. The receipt was created on 23 August 2026 over exactly the bytes struck above, and is served at its own address. The sentence now carries the true stamping date, which is later than the date the page gave. That gap is stated rather than closed: nothing was stamped on 19 August 2026. The document did not change and does not reissue - its hash is the one it has always had. The generator now renders the timestamp only where a receipt exists and refuses to build unless that receipt covers this document.
Two figures and one sentence, corrected at v1.1. v1.0 stated that the June 2026 chapter carries 39 controls; it carries 38, counted at this revision by rendering all nine pages and counting the printed control entries. v1.0 also stated that control ISM-0138 entered the chapter between the March and June releases; it is in neither release of this chapter, and the two control sets are identical. The sentence naming eight controls as this chapter’s is corrected to seven, with the eighth identifier explained as belonging to another chapter.
No finding moves. The finding is that the chapter states the risk in narrative and requires nothing about it in any control, and that holds at either count and in both releases. The error was found on 19 August 2026 by rendering the pages and counting, before any external party raised it. The full account and its reach determination are in the practice’s corrections register.
Three statements withdrawn and one narrowed, at v1.2. v1.1’s version note said the narrative addition was the only substantive change to the chapter between the March and June 2026 releases; a second narrative passage, on data ownership, also changed, and v1.2 quotes both releases. Section 6 said the words reviewed, verified, assured and audited appear in the chapter only for the two registers and for contractual rights to verify compliance; “reviewed” appears at ISM-0072, for contractual security requirements, and v1.2 states each word’s count and place. Section 6 also said ISM-1570 and ISM-1972 carry their provisions at the same revisions and dates as ISM-1793 and ISM-1971; the dates are the same and one revision is not, and v1.2 prints the four. The second and third were in v1.0 as well. Section 4’s sentence that the manual nowhere says its narrative is non-binding was true without ground at manual width and is narrowed to the sections read and a stated term search.
No finding moves. Each was found on 5 September 2026 by this practice, before any external party raised it: the first by reading the pinned March and June chapters against v1.1, the second by reading a sentence beside the counts it rests on, the third by a sweep of every universal in the document. The full account of each, with its reach, is in the practice’s corrections register.
This page said the cover carries 17 August 2026, from 19 August 2026 until this regeneration. The v1.1 cover carries 19 August 2026: a revision’s cover carries the revision date, and the sentence was generated from the first reading’s date. The same defect stood on two other revision pages. It is registered, and the sentence is now read from the built PDF’s first page.
Corrections made before publication are not listed here. They are recorded in the case’s own scope file, which is where the drafting record belongs. This section exists to hold what changes after a reader could have relied on it, and it will say so plainly if that ever happens.
Assessment PDF
SHA-256: a25cc19c8e3bf0173abbe96227ae384dfc8f5f4822ab6dfd2a8da7ea480046d3