Essential Eight AH-ML2.9 Ensure PDF software is securely configured using guidance.
What it says
PDF software is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecure PDF applications based on guidance to protect against hacks.
This control is about making sure your PDF software, like Adobe Reader, is set up in a way that makes it hard for hackers to break in. If you don't do this, a cybercriminal could sneak into your computer just by opening a dodgy PDF file. Securing your PDF software helps protect important information and keeps your computer safe from attacks.
Free. Save your status, tasks and notes.
Why it matters
Weak PDF hardening (e.g., JavaScript, embedded files, auto-launch) can enable malicious PDFs to run code, leading to compromise and data exposure.
How to implement
IT team: Review all PDF software used in the organisation to ensure they support security settings.
Check compatibility with ASD and vendor guidance to apply necessary configurations.
System administrator: Harden PDF software by disabling unnecessary features like JavaScript and multimedia content using guidance from ASD and the software vendor.
Security officer: Ensure all staff are using the most restrictive security settings in PDF software by enforcing these settings through a centralised management tool, like group policy.
IT team: Prevent users from changing security settings by locking configurations via group policy or the management console that comes with the PDF software.
System administrator: Regularly update PDF software to the latest version to patch any security vulnerabilities as per the vendor's instructions.
Keep it running
Configure PDF readers per ASD and vendor hardening (use most restrictive). Disable JavaScript/auto-actions, block embedded files, and verify settings after updates.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
What security settings are applied to the PDF software?
Look at
Check the security configuration settings within the PDF software management console or through central console records.
Good evidence
The PDF software is configured according to the most restrictive ASD and vendor guidance, with all potential security features enabled.
- Check 2 of 3What an auditor asks for
Ask for
Can users modify the PDF software security settings?
Look at
Examine group policy settings or management system configurations showing that user modifications are restricted.
Good evidence
Security settings are locked down and cannot be changed by end-users.
- Check 3 of 3What an auditor asks for
Ask for
How often is the PDF software updated?
Look at
Review update logs or schedules showing regular updates in line with vendor release notes.
Good evidence
The PDF software is updated promptly whenever a new version or patch is released, reducing the risk of exploit.
Mappings
Closest match in ASD Information Security Manual: ISM-1860, Harden PDF applications using ASD guidance, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
E8-AH-ML2.9 requires a secure configuration (hardening) for PDF software based on ASD and vendor guidance. ISO/IEC 27001:2022 Annex A 8.9 is broader, requiring configuration management for IT systems including establishing, documenting, implementing, monitoring and reviewing security configurations. E8-AH-ML2.9 specifically addresses one application class (PDF software) using hardening guidance, whereas Annex A 8.9 is broader in its coverage and lifecycle-oriented approach.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1860.
ISM-1860 requires PDF applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. E8-AH-ML2.9 states the same requirement for PDF software hardening using ASD and vendor guidance with the same conflict-resolution principle. Both controls are aligned in scope (PDF software), intent (secure configuration), and prescriptiveness (follow ASD/vendor guidance with most restrictive precedence).
This control is broader than ISM-1670.
E8-AH-ML2.9 mandates hardening of PDF software using ASD and vendor guidance to reduce exploitation risk. ISM-1670 supports this mandate by requiring a specific mitigation (blocking PDF applications from creating child processes) that is commonly recommended to reduce attack vectors from malicious PDFs. E8-AH-ML2.9 is broader, encompassing general hardening based on guidance, while ISM-1670 provides a specific procedural control enhancing that security posture.
This control partially meets ISM-1246.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive requirement where guidance conflicts. E8-AH-ML2.9 applies the same hardening principle but specifically to PDF software configuration. E8-AH-ML2.9 is therefore a specific instance of the broader server-application hardening expectation in ISM-1246 when PDF software is hosted/used as a server application.
This control partially meets ISM-1858.
ISM-1858 requires IT equipment to be hardened using ASD and vendor guidance, applying the most restrictive requirements where guidance conflicts. E8-AH-ML2.9 applies the same 'ASD + vendor, most restrictive wins' hardening rule but only for PDF software configuration. The candidate is therefore a specific subset of the primary's broader equipment hardening requirement.
This control partially meets ISM-1915.
ISM-1915 necessitates approved configurations for user applications, allowing for a maintained baseline. E8-AH-ML2.9 mandates application hardening, specifically for PDF software, using ASD or vendor guidance which aids operationalisation of ISM-1915's broader requirements.
This control partially overlaps ISM-0289.
ISM-0289 requires evaluated products to be installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. E8-AH-ML2.9 requires PDF software to be hardened using ASD and vendor hardening guidance, which is a concrete instance of applying authoritative configuration guidance to ensure secure operation of a product. E8-AH-ML2.9 is narrower (PDF software hardening and conflict resolution between guides) and does not address the evaluated-product requirement or broader lifecycle administration that ISM-0289 mandates.
- ISM-1470Disable unneeded accounts, components, services and application functionalityPartially overlaps
This control partially overlaps ISM-1470.
E8-AH-ML2.9 requires PDF software to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where there is conflict. ISM-1470 relates by requiring unneeded components, services and functionality of PDF applications (along with other application types) to be disabled or removed, which is a common hardening activity included in PDF hardening baselines. E8-AH-ML2.9 is broader in that it covers the full set of hardening settings derived from guidance (not just removing/ disabling features), while ISM-1470 is broader in application scope (multiple software classes) but narrower in the specific hardening technique it mandates.
This control partially overlaps ISM-1824.
E8-AH-ML2.9 requires PDF software to be hardened using ASD and vendor guidance, ensuring secure baseline settings are applied. ISM-1824 relates by requiring PDF application security settings cannot be changed by users, which helps preserve the hardened configuration established under E8-AH-ML2.9. E8-AH-ML2.9 focuses on selecting and applying hardening settings, whereas ISM-1824 focuses on enforcing configuration immutability to prevent user-driven weakening of those settings.
This control partially overlaps ISM-1859.
E8-AH-ML2.9 requires PDF software to be hardened using ASD and vendor guidance, prioritising the most restrictive settings. ISM-1859 requires hardening of office productivity suites using the same guidance approach, which may include PDF-handling components in some suites but is not necessarily limited to dedicated PDF software. They overlap on the common method (ASD/vendor hardening and conflict resolution), but their application scope differs (PDF software specifically vs broader office suites).
This control depends on ISM-1406.
ISM-1406 requires organisations to use SOEs for workstations and servers to provide a consistent, controlled security baseline. E8-AH-ML2.9 requires PDF software to be securely configured using ASD and vendor hardening guidance, which can be embedded and enforced as part of an SOE build for endpoints and servers where applicable. ISM-1406 does not mandate PDF-specific hardening, but adopting SOEs makes it practical to deploy and maintain those hardened settings consistently.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires defining approved configuration baselines informed by vendor and industry hardening guidance; E8-AH-ML2.9 overlaps for PDF software but goes beyond defining a baseline, requiring it to be hardened using ASD and vendor hardening guidance, the most restrictive taking precedence in conflicts.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML2.9 applies this to PDF software, requiring it to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.