ASD ISM 0042 Maintain effective system administration practices
What it says
System administration processes, and supporting system administration procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure systems are managed effectively with developed and maintained procedures.
This control is about setting up and keeping good habits for managing your computer systems. It's important because if these processes are neglected, things can quickly get disorganised, leading to security weaknesses, data loss, and downtime-especially in a small business or school environment where resources are limited.
Free. Save your status, tasks and notes.
Why it matters
Without documented and maintained system administration processes, admin tasks become inconsistent, increasing misconfigurations, unpatched systems, unauthorised access, and slower incident recovery.
How to implement
The IT team should create a clear, written procedure for routine system checks and updates.
This can be done by listing all the essential tasks needed to keep your systems running smoothly, such as software updates and backups, and assigning team members to specific tasks.
System owners should regularly review these procedures with the IT team.
They can set up monthly meetings to go through what's been working and what needs tweaking, ensuring that the procedures remain up-to-date and effective.
Managers should ensure there is a backup plan in place.
They can work with the IT team to establish ongoing backup schedules and test the backup process at least once a quarter to confirm that data can be restored if something goes wrong.
The procurement officer should have a role in system administration by making sure that any new hardware or software purchases fit the existing management procedures.
They can review new tool requirements with IT before finalising a purchase.
HR should collaborate with the IT team to ensure new staff are trained on basic system use and security practices.
They could organise onboarding training sessions that cover essential system administration processes and security basics.
Keep it running
Maintain documented admin procedures (accounts, patching, backups, change control) and review them after major changes or incidents to keep tasks consistent and repeatable across systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documented system administration procedures: Request the written guide describing standard processes for the IT team.
Look at
Specifics like task frequency and responsible persons.
Good evidence
Is a current document that the IT team says they use regularly.
- Check 2 of 5What an auditor asks for
Ask for
Them about the last time procedures were updated and why.
Look at
Examples showing they've adapted to new challenges or technologies.
Good evidence
Shows they actively maintain and refine the procedures.
- Check 3 of 5What an auditor asks for
Look at
Adherence to documented procedures and efficiency.
Good evidence
Outcome is the task is done smoothly without unexpected issues.
- Check 4 of 5What an auditor asks for
Ask for
Logs or reports of backups conducted, including their success or failure details. Ensure they align with documented procedures.
Good evidence
Log shows consistent backups with any issues addressed promptly.
- Check 5 of 5What an auditor asks for
Ask for
Recent training records: Request documentation on recent staff training regarding system administration practices.
Look at
Completed training with clear objectives and dates.
Good evidence
Includes evidence that all relevant staff attended the sessions.
Mappings
Closest match in ISO/IEC 27001: A.8.13, Backup and recovery procedures for data, which this control covers in full and more.
ISO/IEC 27001: 5 mappings
This control is broader than A.8.13.
ISM-0042 requires organisations to develop, implement and maintain system administration procedures for effective ongoing system operations. Annex A 8.13 requires backup copies to be maintained and regularly tested in accordance with an agreed backup policy, which is typically implemented through operational administration runbooks and procedures. Annex A 8.13 is narrower and focused on backup and recovery activities, while ISM-0042 covers the broader administration operating model and procedure set across many operational practices.
This control is broader than A.8.19.
ISM-0042 requires organisations to maintain holistic system administration processes and procedures that govern operational management activities. Annex A 8.19 specifically requires secure software installation procedures for operational systems, which is one procedural area typically contained within a broader administration framework. Annex A 8.19 is a narrow subset focused on software installation security, while ISM-0042 spans the wider set of administration procedures required to manage systems effectively over time.
This control is broader than A.8.32.
ISM-0042 requires organisations to establish and maintain comprehensive system administration processes and procedures, including controlled operational changes. Annex A 8.32 specifically requires change management procedures for information systems, which is one defined component of effective administration governed by ISM-0042. Annex A 8.32 is narrower and focused on governing changes, whereas ISM-0042 also covers routine administration practices such as standard operating tasks, maintenance activities and procedural consistency across operations.
This control partially overlaps A.5.37.
ISM-0042 requires organisations to develop, implement and maintain end-to-end system administration processes and supporting procedures across the system lifecycle. Annex A 5.37 requires documented operating procedures for information processing facilities to be available to personnel who need them, which directly aligns with ISM-0042's expectation for maintained admin runbooks/SOPs used in day-to-day operations. Annex A 5.37 is primarily about documentation and availability, while ISM-0042 is broader, covering the full practice of system administration (execution, consistency, upkeep and operational governance), not just the existence of procedures.
This control partially overlaps A.8.9.
ISM-0042 requires organisations to develop, implement and maintain effective system administration practices and procedures for managing systems. Annex A 8.9 requires configuration management to be established, documented, implemented, monitored and reviewed, which is a core administrative discipline that operationalises consistent system builds and ongoing control. Annex A 8.9 is deeper and more prescriptive about configuration baselines and monitoring, while ISM-0042 is broader across multiple administration domains beyond configuration management alone.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.6.
Annex A 6.2.6 mandates defining and documenting ongoing AI system operational requirements, such as monitoring, repairs, updates and support. ISM-0042 requires processes for system administration, which include monitoring and support runbooks applicable to AI operations. ISM-0042 is broader, covering all systems, not AI-specific.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.