Controls have a state, and inherit a platform
Every ISM control a system relies on has a state (is it implemented, planned, tailored away) and an inheritance (does the system carry it, or inherit it from a platform underneath). Authorise a platform once and it can export the controls it provides, so every system on it inherits them and only has to implement its own residual. State and inheritance live in the OSCAL SSP layer, which each system fills in; ASD publishes the catalog and the per-classification profiles, not the SSPs.
Drive the model
Sets the real ISM baseline that applies at this classification, and filters the sample list.
The core lever. Toggling it collapses each system's residual as inherited controls grow.
More systems on one authorised platform means more inherited work, done once, not repeated per system.
Illustrative share of the baseline the platform can export. Real inheritance is negotiated per shared-responsibility model.
inherited in the OSCAL SSP, provided by the authorised platform
system-specific, the residual this system owns
What this shows. With no authorised platform every system implements the whole baseline itself, so the blue residual fills the bar. Authorise the platform and the teal inherited segment grows as the blue residual collapses to the controls that are genuinely system-specific. The red slice is what risk-based tailoring removes from the baseline: controls marked not-applicable, with a justification. A control met by an alternative implementation stays in the blue residual, because it is still implemented, just via a compensating measure. Shares are illustrative.
ASD publishes the ISM catalog and the per-classification profiles, not SSPs. A control's state and inheritance live in the OSCAL SSP layer, which each system fills in.
Both fields are core OSCAL. State is the implementation-status property. Inheritance is the SSP's own leveraged-authorization with its provided, inherited and satisfied statements, the mechanism that says which system carries each control. No US authorisation programme is imported to make this work.
The Australian analogue is real but prose-based: ASD Cloud Assessment and Authorisation and the IRAP Common Assessment Framework already run on shared-responsibility control inheritance; it is simply not OSCAL-SSP mandated the way the leveraged-authorization schema is.
Control text: © Commonwealth of Australia (ASD/ACSC), Information Security Manual, OSCAL release v2026.06.18 (June 2026 ISM; OSCAL 1.1.2), reproduced under CC BY 4.0. Independent work; no endorsement by ASD/ACSC implied.
The control rows are a curated sample of 50 items from the full 1,150: 10 of the 49 principles and 40 of the 1,101 controls. That is deliberately not a proportional sample, so the tiles are a scaled illustration and not an estimate. Marking a row not-applicable changes the sampled rate, and the tiles apply that rate to the real baseline to show what it would mean if it held across all of it. Baseline counts and control text are real. Inheritance shares are illustrative. No live AI, and the authorisation decision stays human.