Essential Eight RA-ML3.4 Memory integrity functionality is enabled
What it says
Memory integrity functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure features that protect memory from exploits are enabled to prevent unauthorised code execution.
Having memory integrity functionality enabled means your computer can better protect itself from harmful software trying to take over by hiding in your computer's memory. Think of it as adding an extra layer of bubble wrap to keep your important stuff safe. Without it, attackers can run bad software that might steal your information, slow down your systems, or cause costly disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without memory integrity, attackers can exploit kernel memory flaws to gain high privileges, risking data theft and full system compromise.
How to implement
The IT team should ensure memory integrity is turned on for all computers by checking the security settings within the operating system and then activating it where needed.
System administrators must regularly update computer systems to the latest versions, as these updates often include important security features like memory integrity.
Security officers should train staff on recognising the importance of enabling security features, including memory integrity, to prevent disabling them by accident.
System administrators should verify that all computers have compatible hardware that can support memory integrity, ensuring that the feature can be turned on successfully.
Keep it running
Use Windows Security/Device Security or PowerShell to confirm Memory Integrity (HVCI) stays enabled, and investigate any changes after driver or OS updates.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Have you enabled memory integrity on all applicable systems?
Look at
Review system setting reports or security configuration logs that show the memory integrity status for each device.
Good evidence
All systems show memory integrity as enabled in their configuration logs, with no exceptions.
- Check 2 of 2What an auditor asks for
Ask for
How frequently do you review the compatibility of systems with the latest security updates including memory integrity?
Look at
Examine records of system checks and update schedules for evidence of regular maintenance.
Good evidence
Maintenance records show that memory integrity compatibility and status are checked and updates are applied every month.
Mappings
Closest match in ASD Information Security Manual: ISM-1896, Enable memory integrity for credential protection, which asks for the same thing.
ASD Information Security Manual: 4 mappings
This control is equivalent to ISM-1896.
E8-RA-ML3.4 requires memory integrity functionality to mitigate memory-based attacks and unauthorised code execution. ISM-1896 also requires that memory integrity functionality is enabled. The requirement, scope, and technical intent are substantially the same, meaning implementing one largely satisfies the other.
This control partially meets ISM-1409.
E8-RA-ML3.4 requires enabling memory integrity functionality as a specific hardening measure against exploitation. ISM-1409 requires operating systems to be hardened using ASD and vendor hardening guidance, which typically involves a wide range of security configuration settings across authentication, services, logging, and platform protections. Memory integrity may be included in such guidance, making E8-RA-ML3.4 a more specific requirement within the broader OS hardening approach of ISM-1409.
This control partially meets ISM-1492.
E8-RA-ML3.4 requires memory integrity functionality to be enabled to harden systems against memory-based exploitation and unauthorised code execution. ISM-1492 requires operating system exploit protection functionality to be enabled, which commonly includes multiple mitigations such as CFG, DEP, ASLR, and related exploit protections. Memory integrity is one specific protection under this, making E8-RA-ML3.4 a subset of the broader OS exploit protection posture required by ISM-1492.
This control partially overlaps ISM-1745.
E8-RA-ML3.4 requires memory integrity functionality to be enabled to reduce the likelihood of successful memory exploitation. ISM-1745 mandates boot-chain and early-start protections like Early Launch Antimalware, Secure Boot, Trusted Boot, and Measured Boot to ensure system integrity from startup. These controls complement each other in preventing low-level system compromises, though E8-RA-ML3.4 focuses on runtime memory protection while ISM-1745 focuses on boot and early-load integrity.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RA-ML3.4 requires memory integrity functionality to be enabled, a hardening setting such a baseline would include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.