ASD ISM 1341 Implement HIPS or EDR on workstations
What it says
A HIPS or EDR solution is implemented on workstations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure your computers are protected by constantly monitoring for threats.
This control means you need to set up protective software on your work computers to constantly watch for signs of trouble, like viruses or hackers trying to get in. It matters because if a threat slips through unnoticed, it can lead to data breaches, financial loss, and damage to your business's reputation.
Free. Save your status, tasks and notes.
Why it matters
Without HIPS/EDR on workstations, malware may go undetected, enabling credential theft and data exfiltration before containment.
How to implement
The IT team should choose software designed to spot and block threats on your computers, known as Host-based Intrusion Prevention Systems (HIPS) or Endpoint Detection and Response (EDR).
To do this, research approved products from trusted sources like the Australian Cyber Security Centre (ACSC) or consult with a cyber security expert for advice.
Once the software is chosen, the IT team should install it on all office computers.
This involves downloading the software, running the installation, and ensuring it is set to start checking for issues automatically as soon as the computer is turned on.
Managers must set up regular training sessions for staff to understand the importance of this software and how it works to protect them and the business.
This could be a monthly briefing where staff learn how to respond if the software flags a potential threat.
The IT team should set up alerts so they immediately know when the software detects something unusual.
This usually involves configuring the software to send notifications via email or a dashboard update to those responsible for security oversight.
Every six months, the IT manager should review and update the software to make sure it is still effective against the latest threats.
This includes checking vendor updates and considering any new risks the business may face.
Keep it running
Monitor HIPS/EDR console daily, triage high-severity workstation alerts, and confirm agents/signatures are current and reporting to central management.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of all the workstations where the HIPS or EDR software is installed.
Look at
Whether each item on the list corresponds to an actual workstation in use.
Good evidence
Shows that all operational computers have the software running with no gaps.
- Check 2 of 5What an auditor asks for
Look at
A clear process that involves timely alerts to the right people.
Good evidence
Means alerts are real-time and actionable, not delayed or ignored.
- Check 3 of 5What an auditor asks for
Ask for
To see the training schedule for staff on security measures.
Look at
The frequency and coverage of these training sessions.
Good evidence
Shows regular training involving all relevant staff with attendance records.
- Check 4 of 5What an auditor asks for
Look at
Recent and consistent update records.
Good evidence
Includes regular updates and any changes to settings when threats evolve.
- Check 5 of 5What an auditor asks for
Ask for
A recent incident report involving the HIPS or EDR.
Look at
How quickly and effectively the issue was addressed.
Good evidence
Demonstrates a swift resolution process and follow-up actions.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.1.
Annex A 8.1 requires protecting information stored on or accessible via endpoint devices, including detecting and preventing malicious activity on endpoints. ISM-1341 requires implementing a HIPS or EDR solution on workstations, which directly strengthens endpoint protection against compromise and data exposure. ISM-1341 is narrower because it prescribes one technical control (endpoint detection/prevention) whereas Annex A 8.1 encompasses a broader range of endpoint safeguards.
This control partially meets A.8.7.
ISM-1341 requires a Host-based Intrusion Prevention System (HIPS) or Endpoint Detection and Response (EDR) solution to be implemented on workstations to continuously detect and respond to threats. ISO/IEC 27001:2022 Annex A 8.7 requires organisations to implement protection against malware (typically including endpoint anti-malware controls and supporting awareness). HIPS/EDR is one way to implement endpoint malware/threat protection, but Annex A 8.7 is broader because it can include gateways, filtering, and user awareness beyond just workstation HIPS/EDR.
This control supports A.8.16.
ISM-1341 requires HIPS or EDR on workstations to detect suspicious activity and enable response at the endpoint. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents. Workstation EDR telemetry and detections directly strengthen the organisation's ability to monitor for anomalies, but Annex A 8.16 is broader because it also includes network and application monitoring beyond endpoints.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.