ASD ISM 0912 Establish and manage system configuration changes
What it says
Systems have a change and configuration management plan that includes: - the establishment and maintenance of authorised baseline configurations for systems - what constitutes routine and urgent changes to the configuration of systems - how changes to the configuration of systems will be requested, tracked and documented - who needs to be consulted prior to routine and urgent changes to the configuration of systems - who needs to approve routine and urgent changes to the configuration of systems - who needs to be notified of routine and urgent changes to the configuration of systems - what additional change management and configuration management processes and procedures need to be followed before, during and after routine and urgent changes to the configuration of systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure systems have a plan for managing changes, including approvals and notifications for both routine and urgent updates.
Managing how changes are made to your computer systems might seem straightforward, but without a clear plan, you risk things going wrong, like losing important data or making systems unusable. By having a set process for requesting, approving, and notifying about changes, you can significantly reduce the chance of causing disruptions to your business operations.
Free. Save your status, tasks and notes.
Why it matters
Without a robust change and configuration management plan, unapproved alterations can introduce vulnerabilities and disrupt critical operations.
How to implement
System owners should establish a clear list of what counts as a routine or urgent change to their systems.
They can do this by reviewing past system changes and categorising them based on their impact and how quickly they needed to be implemented.
The IT team should create a formal change request process to request and document all proposed changes.
This might involve filling out a simple form outlining the nature and urgency of the change, and submitting it for review.
Managers need to determine who has the authority to approve changes and ensure this person is informed about their role.
They can do this by assigning change approval responsibilities as part of each system owner's job description.
Communication leads should set up a notification process for informing all relevant personnel of upcoming changes.
This could include emails or meetings to discuss the impact and timing of the changes with affected staff.
System owners and IT teams should regularly review and update the change management plan.
This involves scheduling periodic meetings to discuss any process improvements and amendments based on feedback and incidents.
Keep it running
Log, track and document all routine and urgent change requests; obtain approvals/notifications and audit regularly to prevent drift from authorised baselines.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written change management plan documentation: Ensure it includes definitions for routine and urgent changes.
Look at
How changes are categorised and defined.
Good evidence
Shows there are clear categories with specific examples.
- Check 2 of 5What an auditor asks for
Look at
Completeness and clarity in change descriptions.
Good evidence
Has detailed records for every change made.
- Check 3 of 5What an auditor asks for
Ask for
The list of personnel authorised to approve changes: Verify it matches the people's job descriptions.
Look at
Explicit naming of roles.
Good evidence
Has a decision-maker clearly listed with authority for signing off changes.
- Check 4 of 5What an auditor asks for
Look at
Consistent dates and thorough communication records.
Good evidence
Shows organised and timely notification of each change.
- Check 5 of 5What an auditor asks for
Ask for
Past change review meeting notes: Assess if regular reviews of the process are occurring.
Look at
Agendas and action items in the notes.
Good evidence
Includes records showing that the plan was discussed, and necessary updates were made.
Mappings
Closest match in ISO/IEC 27001: A.5.37, Documented operating procedures for information processing, which partially overlaps with this control.
ISO/IEC 27001: 5 mappings
This control partially overlaps A.5.37.
Annex A 5.37 requires documented and accessible operating procedures for information processing facilities. ISM-0912 requires a change and configuration management plan that defines how configuration changes are requested, tracked, documented, approved and communicated-these are operational procedures for managing system changes. ISM-0912 is specifically scoped to change/configuration management and includes detailed workflow elements, whereas Annex A 5.37 covers a wider range of operational procedures beyond change management.
This control partially overlaps A.8.8.
Annex A 8.8 requires organisations to manage security configuration in response to technical vulnerabilities by assessing exposure and applying appropriate measures. ISM-0912 requires a change and configuration management plan with authorised baselines and defined processes for requesting, approving, tracking and notifying configuration changes, which directly supports controlled security configuration and reduces vulnerability introduced by unmanaged change. They overlap on maintaining secure baselines and governing configuration changes, but Annex A 8.8 also emphasises vulnerability information and exposure evaluation whereas ISM-0912 emphasises governance and workflow for configuration change.
This control partially overlaps A.8.9.
Annex A 8.9 requires configurations of hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. ISM-0912 directly relates by mandating a formal change and configuration management plan including authorised baselines, change classification and governance. While ISM-0912 is more focused on change process mechanics, Annex A 8.9 covers the full configuration lifecycle.
This control partially overlaps A.8.19.
Annex A 8.19 requires controlled, secure processes for installing software on operational systems. ISM-0912 overlaps by mandating change and configuration management plans with baselines, approvals, tracking and documentation, which commonly govern software installation and updates as controlled changes. ISM-0912 is broader because it covers all configuration changes, not just software installs.
This control partially overlaps A.8.32.
ISM-0912 requires organisations to implement a change and configuration management plan that defines and governs routine and urgent configuration changes, including request, tracking, documentation, approvals and notifications. Annex A 8.32 requires that changes to information processing facilities and information systems are subject to change management procedures, directly aligning with the governance of change activity expected by ISM-0912. ISM-0912 is more prescriptive about baseline configurations and the specific roles/steps for urgent versus routine changes, while Annex A 8.32 is higher level and less detailed about configuration baselining and notification requirements.
ISO/IEC 42001: 2 mappings
This control partially overlaps A.6.2.5.
Annex A 6.2.5 requires the organisation to document how an AI system will be deployed and to verify required conditions are satisfied prior to deployment. ISM-0912 supports this by mandating a change and configuration management plan with baseline configurations, change approval, documentation and notifications, which are common prerequisites that must be evidenced before production deployment. ISM-0912 is broader across all systems and changes, while Annex A 6.2.5 is specifically focused on the AI system deployment moment and readiness assurance.
This control partially overlaps A.6.2.6.
Annex A 6.2.6 requires documented ongoing operational requirements for an AI system, including repairs and updates. ISM-0912 requires a change and configuration management plan, which governs how operational repairs and updates are safely introduced into production.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.