Essential Eight AH-ML2.10 PDF software security settings cannot be changed by users
What it says
PDF software security settings cannot be changed by users.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent users from changing PDF software security settings to enhance safety.
This control makes sure that people in the organisation can't change any security settings in the software used to read PDF documents. This is important because if someone could change these settings, it might make it easier for hackers to sneak in harmful software through PDFs.
Free. Save your status, tasks and notes.
Why it matters
If users can change PDF reader security settings, protections may be lowered, enabling malicious PDFs to run code or exfiltrate data.
How to implement
The IT team should set PDF software configuration policies in place.
They can do this using group policies or equivalent settings to lock down PDF reader settings, ensuring users can't alter them.
System administrators should install PDF software updates regularly.
Keep the software up to date using automated tools to patch any security risks.
Security officers should perform regular checks to confirm PDF security settings are intact.
Use security tools that can scan these settings and alert if they have been changed.
IT support should educate staff on safe handling of PDF files.
Conduct training sessions to help users understand why certain settings are locked and the risks associated with opening unknown PDFs.
Keep it running
Enforce and lock PDF reader security preferences via central policy; disable risky features (e.g., JavaScript) and alert on config drift.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are PDF security settings restricted from user modification?
Look at
Examine the group policy objects or software settings enforcing PDF security configurations.
Good evidence
Policies should show that settings are locked (often greyed out) for users, ensuring that only authorised personnel can change them.
- Check 2 of 2What an auditor asks for
Ask for
How are updates to the PDF software managed?
Look at
Review update logs or deployment strategies.
Good evidence
The organisation should have a documented process for regular, automated updates to PDF software.
Mappings
Closest match in ASD Information Security Manual: ISM-1824, Lock PDF application security settings against user changes, which asks for the same thing.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1824.
E8-AH-ML2.10 requires that PDF software security settings are enforced such that users cannot change them. ISM-1824 states the same requirement for PDF application security settings, aiming to prevent users from weakening protections (e.g. disabling safe handling features). Both controls align in scope (PDF applications) and intent (lock down user-modifiable security configuration) such that implementing one would largely satisfy the other.
This control partially meets ISM-1825.
ISM-1825 requires that users cannot change security product security settings, preventing weakening of security controls. E8-AH-ML2.10 is a specific instance of this principle for PDF software security settings being immutable by users. ISM-1825 has wider scope as it is not confined to PDF software and applies to security products generally.
This control partially meets ISM-1858.
ISM-1858 requires organisations to harden IT equipment using ASD and vendor guidance, applying the most restrictive requirements when guidance conflicts. E8-AH-ML2.10 requires PDF software security settings to be immutable by users, enforcing a hardened configuration state for that software. This is a subset of ISM-1858 because it is limited to PDF software and focuses on preventing unauthorised configuration change.
This control partially meets ISM-2110.
ISM-2110 requires organisations to harden user applications using ASD and vendor guidance, prioritising the strictest requirements. E8-AH-ML2.10 focuses specifically on locking down PDF application security settings so users cannot weaken them, which is a common hardening outcome expected when applying vendor/ASD baselines under ISM-2110. The candidate is narrower because it applies to one application class and one hardening outcome, while ISM-2110 covers all user applications and the full set of hardening guidance.
This control partially overlaps ISM-1489.
E8-AH-ML2.10 requires preventing users from changing PDF software security settings. ISM-1489 similarly requires preventing users from changing Microsoft Office macro security settings, which is the same governance pattern (users cannot weaken application security) applied to a different application domain. The overlap is in the control mechanism (enforced, centrally managed application security settings), but the protected technology (PDF vs Office macros) differs.
This control partially overlaps ISM-1823.
E8-AH-ML2.10 requires that PDF software security settings cannot be changed by users. ISM-1823 similarly requires preventing user changes to security settings, but specifically for an office productivity suite rather than PDF software. They overlap in the governance approach of enforcing security configuration via administrative control, but they apply to different application classes and therefore do not fully satisfy each other.
This control depends on ISM-1915.
ISM-1915 ensures that approved configurations for user applications are sustained. E8-AH-ML2.10 demands that PDF software security settings remain immutable by users, complementing ISM-1915 by preventing unauthorised changes.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML2.10 requires that PDF software security settings cannot be changed by users, which protects those settings in such a baseline.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.