ASD ISM 0289 Implement and manage evaluated products correctly
What it says
Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure evaluated products are set up and run correctly following vendor instructions and evaluated settings.
This control is about making sure any security products you've bought that have been officially evaluated are set up and used exactly as the instructions say. If you don't, they might not protect you properly, leading to data breaches or system failures.
Free. Save your status, tasks and notes.
Why it matters
Failure to adhere to evaluated settings may lead to exploitable security gaps, invalidating the product's assurance and exposing the organisation to breaches.
How to implement
System administrators should follow the vendor's installation manual and configuration guide for evaluated products.
This involves reading the instructions carefully and setting the system up as described, without skipping any steps.
IT managers should verify that all security settings match the vendor's recommended configurations.
This means checking each setting against a list provided by the vendor to ensure compliance.
The IT team should conduct a training session for staff using these products, making sure they understand how to operate the system effectively.
This can be done by running a workshop and providing easy-to-follow user guides.
Procurement officers need to make sure they have the latest vendor documentation when acquiring evaluated products.
This involves contacting the vendor or checking their website for any updates or amendments to manuals and guides.
Regular audits should be set up by internal auditors to confirm these products are still configured correctly over time.
This can be done by scheduling periodic reviews and matching current settings with initial setup documents.
Keep it running
Regularly validate evaluated configuration baselines and vendor guidance; use change control, configuration drift monitoring and audits to prevent non-evaluated settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the vendor's installation and setup guide: Check that it is the latest version and was used during the product installation.
Good evidence
Shows the guide with notations or electronic marks indicating it was followed step-by-step.
- Check 2 of 5What an auditor asks for
Ask for
To see system configuration reports: Review these against vendor-recommended settings.
Good evidence
Includes a comparison document or spreadsheet showing each setting checked off.
- Check 3 of 5What an auditor asks for
Ask for
Them to describe the materials and any follow-up learning activities.
Good evidence
Includes comprehensive training records and user acknowledgments.
- Check 4 of 5What an auditor asks for
Good evidence
Observation shows no deviations from the established procedures.
- Check 5 of 5What an auditor asks for
Good evidence
Record shows regular audits with documented compliance with vendor guidelines.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.9.
ISM-0289 requires evaluated products to be installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. Annex A 8.9 requires configurations (including security configurations) for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which overlaps with preventing configuration drift from an approved state. Annex A 8.9 is broader configuration governance across all ICT, while ISM-0289 is more specific about maintaining the product's evaluated configuration and following vendor operating guidance.
This control partially overlaps A.8.19.
Annex A 8.19 requires secure management of software installation on operational systems. ISM-0289 overlaps by mandating evaluated products to be installed and operated in their evaluated configuration according to vendor guidance, constraining how software is installed and configured. ISM-0289 is narrower since it applies to evaluated products, unlike Annex A 8.19 which applies generally.
ASD Essential Eight: 3 mappings
This control partially overlaps E8-AH-ML2.5.
ISM-0289 requires evaluated products to be configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. E8-AH-ML2.5 mandates a specific Microsoft Office configuration to prevent activation of OLE packages, which is a tangible example of enforcing secure product configuration settings. E8-AH-ML2.5 is a single hardening requirement for one product family, whereas ISM-0289 is broader and anchored to maintaining the overall evaluated configuration and correct operational state of any evaluated product.
This control partially overlaps E8-AH-ML2.6.
ISM-0289 requires evaluated products to be installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. E8-AH-ML2.6 requires office productivity suites to be hardened using ASD and vendor guidance, overlapping on implementing and maintaining vendor-aligned secure configuration for operational software. E8-AH-ML2.6 is limited to a specific application class and hardening outcomes, while ISM-0289 is tied to the integrity of an evaluated configuration and applies across any evaluated product and its ongoing administration and operation.
This control partially overlaps E8-AH-ML2.9.
ISM-0289 requires evaluated products to be installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance. E8-AH-ML2.9 requires PDF software to be hardened using ASD and vendor hardening guidance, which is a concrete instance of applying authoritative configuration guidance to ensure secure operation of a product. E8-AH-ML2.9 is narrower (PDF software hardening and conflict resolution between guides) and does not address the evaluated-product requirement or broader lifecycle administration that ISM-0289 mandates.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.