ASD ISM 1211 System administration performed under change and configuration management plan
What it says
System administration activities are performed in accordance with the system's change and configuration management plan.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAdministrators only make changes to a system by following its approved change and configuration management plan, so every administrative action is planned, authorised and recorded.
Every system should have a change and configuration management plan that sets out how changes are proposed, assessed, approved, implemented and recorded, and how the system's approved configuration is maintained. This control requires that the people who administer the system actually work within that plan when they carry out their administrative activities, rather than treating the plan as a document that sits on a shelf. In practice, that means an administrator who patches a server, adjusts a firewall rule, creates a privileged account, alters a group policy, or changes a build image does so through the process the plan describes: the activity is raised, assessed and approved in the way the plan requires, carried out as approved, and the resulting configuration is recorded so the system's documented state stays accurate. Why this matters: unmanaged administration is one of the most common ways a well-designed system drifts into an insecure state. A "quick fix" that bypasses the process can silently disable a hardening setting, open a port, weaken logging or leave a temporary account behind, and nobody knows because nothing was recorded. When something later breaks or is compromised, the organisation cannot tell what changed, when, by whom, or why. Requiring administration to follow the plan keeps the real system aligned with its approved and assessed configuration, preserves the value of the security assessment and authorisation, and gives investigators and auditors a reliable trail.
Free. Save your status, tasks and notes.
Why it matters
If system administration is carried out outside the change and configuration management plan, the system's actual configuration drifts away from its approved and assessed baseline without anyone being aware. Hardening settings can be weakened, unnecessary services or accounts introduced, and security controls disabled by ad hoc administrative work. Outages and security incidents become harder to diagnose because there is no reliable record of what was changed, when and by whom. Security assessments and authorisations lose their validity because they no longer describe the system as it really is, and the organisation has little assurance that administrators are acting only within approved boundaries.
How to implement
The system owner and administration team lead confirm that the system has a current change and configuration management plan, and that it explicitly covers the types of administrative activity performed on the system (patching, configuration changes, account and privilege management, software installation and build changes) so administrators know which activities fall under it.
The administration team lead writes the plan's steps (request, assessment, approval, implementation, verification and recording) into the team's standard operating procedures and runbooks, so following the plan is the default way administrative work is performed rather than an extra step.
The change manager defines a catalogue of pre-approved standard changes for routine, low-risk administrative tasks and an emergency change path for urgent work, so administrators have a practical route within the plan for every kind of activity and are not tempted to bypass it.
The administration team lead configures administrative tooling and ticketing so that administrative actions are linked to an approved change record, for example requiring a change reference before privileged tasks are executed and capturing privileged session logs against that reference.
The system owner arranges for every administrator to be briefed on the change and configuration management plan before privileged access is granted, and schedules periodic reconciliation of configuration records and privileged activity logs against approved changes to confirm administration is being performed in accordance with the plan.
Keep it running
Day to day, this control lives in the habits of the administration team. Administrators should treat the change and configuration management plan as the operating procedure for their work: no configuration-affecting activity starts without the request, assessment and approval steps the plan requires, and no activity finishes until the configuration records are updated.
Routine, repeatable activities (such as scheduled patching or standard account provisioning) are usually handled through pre-approved standard changes defined in the plan, so administrators are not forced into a full review for every low-risk task. Emergency administration still follows the plan's emergency change path, with retrospective assessment and recording rather than no recording at all.
Team leads should periodically compare change and configuration records against what was actually done on the system (privileged session logs, configuration snapshots, tooling audit trails) to catch administration that bypassed the plan. Where gaps are found, the cause is usually either an impractical plan or unclear expectations, and both should be fixed rather than tolerated. New administrators should be inducted into the plan before receiving privileged access, and the plan should be reviewed whenever administrative tooling or system architecture changes so that it remains something administrators can genuinely follow.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the system's current change and configuration management plan and the administration team's operating procedures or runbooks.
Look at
Check whether the plan actually addresses the administrative activities performed on the system and whether the procedures administrators use reference and follow the plan's steps.
Good evidence
The plan is current and approved, covers the real administrative activities, and the procedures administrators work from clearly embed the plan's request, approval, implementation and recording steps.
- Check 2 of 5What an auditor asks for
Ask for
Ask for change records covering a recent period, including standard, normal and emergency changes.
Look at
Select a sample of administrative activities and trace each through request, assessment, approval, implementation and closure as described in the plan.
Good evidence
Each sampled activity has a complete record showing it was approved before implementation (or retrospectively for emergencies, as the plan allows) and closed with the outcome recorded.
- Check 3 of 5What an auditor asks for
Ask for
Ask for privileged session logs or administrative tooling audit trails for the same period.
Look at
Compare the administrative actions in the logs against the change records to see whether any activity took place without a corresponding approved change.
Good evidence
Administrative actions in the logs can be matched to approved change records, and any unmatched activity has been identified and dealt with by the organisation, not first discovered by the auditor.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the system's configuration records or baseline documentation and any recent configuration reconciliation results.
Look at
Check whether the recorded configuration reflects recent changes and whether the organisation compares the live system against the recorded configuration.
Good evidence
Configuration records are updated as part of closing each change, and periodic reconciliation shows the live system matches the recorded configuration or explains any variance.
- Check 5 of 5What an auditor asks for
Ask for
Ask to speak with two or three system administrators and to see their induction or briefing records on the plan.
Look at
Ask them to describe how they would carry out a routine change, an urgent change and a new privileged account, and check that their answers match the plan.
Good evidence
Administrators describe the plan's process accurately from their own daily practice, were briefed on it before receiving privileged access, and can point to how emergency work is still recorded.
Mappings
Closest match in ISO/IEC 27001: A.8.32, Change management procedures for information systems, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.32.
ISM-1211 requires system administrators to perform administration activities in accordance with the system's approved change and configuration management plan, ensuring actions are authorised and recorded. Annex A 8.32 requires changes to information systems and information processing facilities to be subject to change management procedures across the organisation. ISM-1211 is a specific enforcement point (administrator conduct on a given system) within the broader organisational change management expectation in Annex A 8.32, and it also explicitly includes configuration management alongside change control.
This control partially overlaps A.8.9.
ISM-1211 requires administrative actions that alter a system to follow an approved change and configuration management plan so changes are planned, authorised and recorded. Annex A 8.9 requires secure configurations to be established, documented, implemented, monitored and reviewed across hardware, software, services and networks. They overlap where the change/config plan in ISM-1211 is used to control and record configuration changes, while Annex A 8.9 goes further into baselining, continuous monitoring and periodic review of configurations beyond the act of administering changes.
This control supports A.8.19.
ISM-1211 requires software- and configuration-affecting administration to be executed under an approved change and configuration management plan with authorisation and recording. Annex A 8.19 requires secure software installation procedures and measures for operational systems (e.g., controlled installation methods, integrity checks, and restricting who can install). ISM-1211 supports Annex A 8.19 by providing the governance and traceability mechanism that ensures installations occur only via approved, recorded administrative processes, but it does not itself specify the secure installation safeguards that Annex A 8.19 expects.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-01.2Use secure build and deployment processes to enforce security controls consistentlyPartially overlaps
This control partially overlaps IT.PRO-01.2.
IT.PRO-01.2 requires secure build and deployment processes that enforce controls consistently across systems; ISM-1211 supports that consistency, requiring system administration activities to follow the system's change and configuration management plan.
- IT.PRO-04.3Detect and remediate configuration drift using scheduled assessments and automated monitoringPartially overlaps
This control partially overlaps IT.PRO-04.3.
IT.PRO-04.3 requires detecting and responding to configuration drift via scheduled assessments and, where supported, automated monitoring; ISM-1211 covers the prevention side, requiring system administration to follow the system's change and configuration management plan.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.