ASD ISM 1246 Apply strict server application hardening guidelines
What it says
Server applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishServers are secured using the most restrictive guidance from ASD and vendors to protect against vulnerabilities.
This control is about strengthening the security of server applications by following strict guidelines to reduce the risk of cyber attacks. If server applications are not properly secured, they can be vulnerable to hackers, potentially leading to data breaches and serious disruptions to your business.
Free. Save your status, tasks and notes.
Why it matters
Without strict server application hardening (ASD/vendor baselines), default settings and weak services may be exploited, enabling unauthorised access or outages.
How to implement
The IT team should gather hardening guidelines from both the Australian Signals Directorate and the application vendors.
This involves visiting the respective websites and downloading the latest guidance documents or security bulletins.
The system administrator should review these guidelines to identify any conflicting recommendations.
This can be done by creating a comparison list and deciding which guidance to follow, prioritising the stricter set of rules.
The IT manager should ensure that these hardening measures are applied to each server application.
This involves updating configurations as per the guidelines and checking that no recommended security settings are missed.
IT staff should conduct regular training sessions for everyone involved in server management.
These sessions ensure all personnel are aware of the importance of adhering to the strict guidelines and know how to implement them effectively.
The business owner should allocate resources for regular secutiry audits of the server applications to ensure continued compliance with the strictest hardening guidelines.
This ensures that security configurations are up-to-date and effective.
Keep it running
Maintain ASD and vendor hardening baselines for each server app; review updates and, where guidance conflicts, implement the most restrictive settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documented record of the hardening guidelines used: Request a list showing both the Australian Signals Directorate and vendor guidelines consulted.
Look at
The dates and details to ensure they are the most current and detailed.
Good evidence
Is an up-to-date list with notes on the decisions made for each conflict.
- Check 2 of 5What an auditor asks for
Ask for
Configuration settings documentation: Review the settings applied to each server application against the list of guidelines.
Look at
Settings that strictly adhere to the most stringent guidance.
Good evidence
A document verifying compliance with no skipped steps.
- Check 3 of 5What an auditor asks for
Ask for
Training records for IT staff: Look into attendance records and training material to ensure sessions cover the security guidelines comprehensively.
Good evidence
Comprehensive coverage of the guidelines and 100% attendance by relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Security audit reports: Ensure audits cover whether server applications are compliant with the strictest guidelines.
Look at
Detailed assessments that check each guideline implemented correctly.
Good evidence
Includes a passed audit with clear notes on each guideline checked.
- Check 5 of 5What an auditor asks for
Ask for
The change logs for server application configurations: Check if changes align with the strictest guidelines and when they were implemented.
Look at
A change log that shows regular updates and clearly follows the latest guidelines.
Good evidence
Includes regular updates with documented rationale for each change.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.6, Office productivity suites are hardened using ASD and vendor guidance, which this control covers in full and more.
ASD Essential Eight: 6 mappings
This control is broader than E8-AH-ML2.6.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive requirement where guidance conflicts. E8-AH-ML2.6 requires the same hardening approach but for office productivity suites. If productivity suites are installed on servers (e.g. for automation or remote app delivery), E8-AH-ML2.6 represents a specific subset of the broader server application hardening obligation in ISM-1246.
This control is broader than E8-AH-ML2.9.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive requirement where guidance conflicts. E8-AH-ML2.9 applies the same hardening principle but specifically to PDF software configuration. E8-AH-ML2.9 is therefore a specific instance of the broader server-application hardening expectation in ISM-1246 when PDF software is hosted/used as a server application.
This control partially meets E8-AH-ML2.1.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive requirement where guidance conflicts. E8-AH-ML2.1 applies the same hardening approach but focuses on web browsers. Where browser components or embedded browser engines are present on servers (e.g. server management consoles or published apps), E8-AH-ML2.1 is a subset of the broader hardening requirement in ISM-1246.
This control partially overlaps E8-AH-ML3.1.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance with the most restrictive precedence. E8-AH-ML3.1 mandates the removal/disablement of legacy .NET Framework versions, part of server application hardening baselines. E8-AH-ML3.1 focuses on a single technology control, whereas ISM-1246 applies to all server applications.
This control partially overlaps E8-AH-ML3.2.
ISM-1246 requires server applications to be hardened with ASD and vendor guidance, applying the most restrictive guidance where conflicts occur. E8-AH-ML3.2 requires disabling/removing Windows PowerShell 2.0, a specific hardening measure. E8-AH-ML3.2 is a single prescriptive configuration, while ISM-1246 covers broader end-to-end application hardening for servers.
This control partially overlaps E8-AH-ML3.3.
ISM-1246 ensures server applications are hardened using ASD/vendor guidance, following the most restrictive precedence. E8-AH-ML3.3 configures PowerShell to use Constrained Language Mode, a hardening control potentially required by server hardening baselines. Though E8-AH-ML3.3 is limited to PowerShell, ISM-1246 applies comprehensively to all server applications.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1246 applies this to server applications, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.