What does ASD ISM 1211 require?

policyASD Information Security Manual (ISM)

ASD ISM 1211System Administration Performed Under Change and Configuration Management Plan

Official control statement

System administration activities are performed in accordance with the system's change and configuration management plan.

policyASD Information Security Manual (ISM)ISM-1211

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Administrators only make changes to a system by following its approved change and configuration management plan, so every administrative action is planned, authorised and recorded.

NC OS PASD Information Security ManualGuidelines for system management

Control Stack classificationPreventative Change management Configuration management

record_voice_over

What this means in practice

Every system should have a change and configuration management plan that sets out how changes are proposed, assessed, approved, implemented and recorded, and how the system's approved configuration is maintained. This control requires that the people who administer the system actually work within that plan when they carry out their administrative activities, rather than treating the plan as a document that sits on a shelf. In practice, that means an administrator who patches a server, adjusts a firewall rule, creates a privileged account, alters a group policy, or changes a build image does so through the process the plan describes: the activity is raised, assessed and approved in the way the plan requires, carried out as approved, and the resulting configuration is recorded so the system's documented state stays accurate. Why this matters: unmanaged administration is one of the most common ways a well-designed system drifts into an insecure state. A "quick fix" that bypasses the process can silently disable a hardening setting, open a port, weaken logging or leave a temporary account behind, and nobody knows because nothing was recorded. When something later breaks or is compromised, the organisation cannot tell what changed, when, by whom, or why. Requiring administration to follow the plan keeps the real system aligned with its approved and assessed configuration, preserves the value of the security assessment and authorisation, and gives investigators and auditors a reliable trail.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2026

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for system management

Section

System administration

Topic

System administration processes and procedures

priority_high

Why it matters

If system administration is carried out outside the change and configuration management plan, the system's actual configuration drifts away from its approved and assessed baseline without anyone being aware. Hardening settings can be weakened, unnecessary services or accounts introduced, and security controls disabled by ad hoc administrative work. Outages and security incidents become harder to diagnose because there is no reliable record of what was changed, when and by whom. Security assessments and authorisations lose their validity because they no longer describe the system as it really is, and the organisation has little assurance that administrators are acting only within approved boundaries.

settings

Operational notes

Day to day, this control lives in the habits of the administration team. Administrators should treat the change and configuration management plan as the operating procedure for their work: no configuration-affecting activity starts without the request, assessment and approval steps the plan requires, and no activity finishes until the configuration records are updated.

Routine, repeatable activities (such as scheduled patching or standard account provisioning) are usually handled through pre-approved standard changes defined in the plan, so administrators are not forced into a full review for every low-risk task. Emergency administration still follows the plan's emergency change path, with retrospective assessment and recording rather than no recording at all.

Team leads should periodically compare change and configuration records against what was actually done on the system (privileged session logs, configuration snapshots, tooling audit trails) to catch administration that bypassed the plan. Where gaps are found, the cause is usually either an impractical plan or unclear expectations, and both should be fixed rather than tolerated. New administrators should be inducted into the plan before receiving privileged access, and the plan should be reviewed whenever administrative tooling or system architecture changes so that it remains something administrators can genuinely follow.

02 - Implement

build

Implementation tips

The system owner and administration team lead confirm that the system has a current change and configuration management plan, and that it explicitly covers the types of administrative activity performed on the system (patching, configuration changes, account and privilege management, software installation and build changes) so administrators know which activities fall under it.
The administration team lead writes the plan's steps (request, assessment, approval, implementation, verification and recording) into the team's standard operating procedures and runbooks, so following the plan is the default way administrative work is performed rather than an extra step.
The change manager defines a catalogue of pre-approved standard changes for routine, low-risk administrative tasks and an emergency change path for urgent work, so administrators have a practical route within the plan for every kind of activity and are not tempted to bypass it.
The administration team lead configures administrative tooling and ticketing so that administrative actions are linked to an approved change record, for example requiring a change reference before privileged tasks are executed and capturing privileged session logs against that reference.
The system owner arranges for every administrator to be briefed on the change and configuration management plan before privileged access is granted, and schedules periodic reconciliation of configuration records and privileged activity logs against approved changes to confirm administration is being performed in accordance with the plan.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for the system's current change and configuration management plan and the administration team's operating procedures or runbooks.Look atCheck whether the plan actually addresses the administrative activities performed on the system and whether the procedures administrators use reference and follow the plan's steps.GoodThe plan is current and approved, covers the real administrative activities, and the procedures administrators work from clearly embed the plan's request, approval, implementation and recording steps.
AskAsk for change records covering a recent period, including standard, normal and emergency changes.Look atSelect a sample of administrative activities and trace each through request, assessment, approval, implementation and closure as described in the plan.GoodEach sampled activity has a complete record showing it was approved before implementation (or retrospectively for emergencies, as the plan allows) and closed with the outcome recorded.
AskAsk for privileged session logs or administrative tooling audit trails for the same period.Look atCompare the administrative actions in the logs against the change records to see whether any activity took place without a corresponding approved change.GoodAdministrative actions in the logs can be matched to approved change records, and any unmatched activity has been identified and dealt with by the organisation, not first discovered by the auditor.
AskAsk for the system's configuration records or baseline documentation and any recent configuration reconciliation results.Look atCheck whether the recorded configuration reflects recent changes and whether the organisation compares the live system against the recorded configuration.GoodConfiguration records are updated as part of closing each change, and periodic reconciliation shows the live system matches the recorded configuration or explains any variance.
AskAsk to speak with two or three system administrators and to see their induction or briefing records on the plan.Look atAsk them to describe how they would carry out a routine change, an urgent change and a new privileged account, and check that their answers match the plan.GoodAdministrators describe the plan's process accurately from their own daily practice, were briefed on it before receiving privileged access, and can point to how emergency work is still recorded.

04 - Mappings

link

Cross-framework mappings

How ISM-1211 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(1)expand_less
Annex A 8.32	ISM-1211 requires system administrators to perform administration activities in accordance with the system's approved change and configur...
sync_altPartially overlaps(1)expand_less
Annex A 8.9	ISM-1211 requires administrative actions that alter a system to follow an approved change and configuration management plan so changes ar...
handshakeSupports(1)expand_less
Annex A 8.19	ISM-1211 requires software- and configuration-affecting administration to be executed under an approved change and configuration manageme...