Skip to content
System hardening
ASD ISMISM-1245

ASD ISM 1245 Remove temporary files after server installation

What it says

All temporary installation files created during server application installation processes are removed after server applications have been installed.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure temporary files are deleted after installing server applications to maintain system security.

After you install server software, it creates temporary files that help with the setup. If you don't delete these files, they could be used by attackers to harm your servers, potentially leading to data breaches or server breakdowns.

Why it matters

If temporary files are not deleted, they could expose servers to attacks, risking data breaches or server failures that disrupt business operations.

How to implement

  1. The IT team should identify temporary files created during server installations.

    This can be done by checking installation logs or software documentation to locate where these files are usually stored.

  2. System administrators should configure automatic scripts to remove temporary files post-installation.

    Using file management tools, they can set up scheduled tasks to clean up after installations.

  3. Managers should ensure IT staff are trained on recognising and managing installation files.

    Hold training sessions with clear examples of what these files look like and the risks of not deleting them.

  4. Procurement teams should include deletion clauses in software purchase agreements.

    Ensure agreements require vendors to document all temporary files their software creates and how to securely remove them.

  5. The IT security officer should periodically review server setups to ensure this control is followed.

    They can perform spot checks on recently installed servers to confirm temporary files are routinely deleted.

Keep it running

Regularly monitor server installations to ensure temporary files are consistently deleted to reduce security risks. Keep staff trained and agreements up-to-date.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the documented procedures covering temporary file management during server application installation.

    Look at

    Look for clear steps on identifying and deleting temporary installation files once the application is installed.

    Good evidence

    A good answer includes specific file paths and the deletion methods used.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Request examples of recent server installations, including the post-installation steps that were carried out.

    Look at

    Check whether temporary installation files were identified and deleted after the application was installed.

    Good evidence

    Good evidence includes logs showing the cleanup was actually performed.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for training records verifying that IT staff understand the risks of leaving temporary installation files on servers.

    Look at

    Look for attendance logs and the training material used.

    Good evidence

    A good answer shows regular and comprehensive training sessions on this topic.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Request agreements with software vendors that relate to temporary file management during installation.

    Look at

    Look for clauses requiring the deletion of installation files after server applications are installed.

    Good evidence

    A good answer shows these requirements are clearly stated and enforced.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for the review report from the IT security officer's spot checks on temporary file deletion.

    Look at

    Look at the findings on whether temporary installation files were removed after installations.

    Good evidence

    Good reports include specific incidents, corrections made, and recommendations for future installations.

Mappings

Closest match in ISO/IEC 27001: A.8.19, Secure software installation procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.19Secure software installation proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.