ASD ISM 0917 Procedures for handling malicious code infections
What it says
When malicious code is detected, the following steps are taken to handle the infection: - the infected systems are isolated - all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary - antivirus applications are used to remove the infection from infected systems and media - if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystems with malware are isolated, scanned, cleansed, or restored to stop the infection.
If your computer system gets a virus or other malicious software, it's important to take specific steps to stop it from spreading and causing extra trouble. This control is crucial because failing to act quickly could lead to bigger issues like data theft, a shut down of your systems, or high costs to fix the damage.
Free. Save your status, tasks and notes.
Why it matters
If infections aren't quickly isolated and previously connected media scanned, malware can spread and persist, causing outages, data loss and costly rebuilds.
How to implement
The IT team should isolate infected systems immediately.
This means disconnecting the affected computer or device from the network to prevent the virus from spreading. Make sure to have a clear procedure in place that guides which cables to unplug or how to switch off wireless connections.
Managers should ensure that all devices connected to the infected system are scanned.
This includes any USB drives or external hard drives used recently. Use reliable antivirus software for scanning and have a checklist to ensure all potential sources of infection are checked.
The IT department should remove the virus using antivirus applications.
Select antivirus tools that are effective against a range of threats, update them regularly, and conduct thorough scans on all affected systems. If unsure what software to use, consult the Australian Cyber Security Centre's (ACSC) guidelines.
System owners should prepare for situations where the virus can't be removed.
Keep regular backups and test restoration processes periodically. Make sure backups are recent and stored securely off the network, ready to be used if the system needs to be restored.
IT managers should establish a protocol for rebuilding systems if necessary.
This involves reinstalling the operating system and applications from scratch, ensuring all security updates are applied. Create a step-by-step procedure document to guide this process in emergency situations.
Keep it running
On detection, immediately isolate infected hosts, scan/quarantine all recently connected media, attempt AV removal, and restore from known-good backups or rebuild if removal is unreliable.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident response procedure documentation: This should cover how to isolate an infected system and the assigned team.
Look at
The clarity and detail in the instructions provided.
Good evidence
Detailed steps including who is responsible and a record of the last procedure review.
- Check 2 of 5What an auditor asks for
Look at
Dates and a summary of actions taken.
Good evidence
Dated reports showing infected devices were scanned and actions to clean them were initiated.
- Check 3 of 5What an auditor asks for
Ask for
Records of system backups: Check how often backups are done and where they are stored.
Good evidence
Documentation that backups are done regularly, with a point-in-time copy stored securely and tested for restorability.
- Check 4 of 5What an auditor asks for
Look at
A list of software with version numbers and update logs.
Good evidence
An updated list showing regularly maintained antivirus tools in accordance with ACSC guidelines.
- Check 5 of 5What an auditor asks for
Ask for
Protocol documentation for system rebuilding: This should detail how systems are rebuilt if the virus can't be removed.
Look at
Comprehensive steps and any team training records.
Good evidence
A clear protocol exists, detailing each step, with records showing staff informed and trained.
Mappings
Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.26.
ISM-0917 defines a specific set of documented response steps for malicious code infections, including isolation, scanning media, removal, and restoration/rebuild. Annex A 5.26 requires that information security incidents are responded to in accordance with documented procedures across incident types. ISM-0917 is therefore a concrete, malware-focused instance of the broader incident response requirement in Annex A 5.26.
This control partially overlaps A.8.7.
ISM-0917 requires organisations to handle detected malware by containing it (isolation), assessing spread (scanning connected media), eradicating it (antivirus), and recovering (restore/rebuild). Annex A 8.7 requires implementing protection against malware, typically covering preventive and detective controls as well as supporting processes. They overlap on malware response/eradication elements, but Annex A 8.7 is broader (prevention and awareness), while ISM-0917 is specifically the post-detection handling procedure.
This control partially overlaps A.8.13.
ISM-0917 requires organisations to isolate malware-infected systems, scan potentially exposed media, attempt removal using antivirus, and restore or rebuild if removal is unreliable. Annex A 8.13 requires maintaining and testing backups so systems and data can be recovered. They overlap where ISM-0917 explicitly uses restoration from a known good backup as a remediation path, while Annex A 8.13 is broader backup governance and testing rather than malware-specific handling steps.
ASD Essential Eight: 1 mapping
This control depends on E8-RB-ML1.4.
E8-RB-ML1.4 requires organisations to test restoring data, applications, and settings from backups during disaster recovery exercises. ISM-0917 involves restoring from a known good backup during malware incidents, where E8-RB-ML1.4 proves the effectiveness under exercises.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.