ASD ISM 1406 Use SOEs for workstations and servers
What it says
SOEs are used for workstations and servers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse pre-configured software setups for all computers and servers to ensure consistency and security.
Standard Operating Environments (SOEs) mean setting up computers and servers to all use the same, secure software and settings. This matters because it keeps everything consistent and safe, and helps prevent hackers from finding weak spots by always having the latest protective measures in place.
Free. Save your status, tasks and notes.
Why it matters
Without SOEs, workstations and servers diverge from approved baselines, increasing misconfiguration risk and making patching and compliance harder.
How to implement
The IT team should create a standard setup for all computers and servers.
This means choosing a specific operating system and important programs that everyone will use and ensuring they are up to date with the latest security patches.
A manager should oversee the process to make sure all staff computers and office servers follow these standard setups.
This involves regularly checking devices to ensure they haven't been changed or customised without approval.
System owners should regularly review and update the SOE to include the latest security patches and features.
They can do this by setting a schedule, like quarterly, to check for new updates or changes in security risks.
IT staff should train employees on the importance of using the organisation's standard setups and the risks of installing unauthorised software.
This can be done through periodic workshops or information sessions.
The procurement team should ensure new equipment purchases align with the standard setups.
They can achieve this by working closely with IT to select compatible hardware that supports the chosen operating systems and software.
Keep it running
Maintain and version SOE images; patch and harden regularly, and verify deployed builds match the SOE to prevent configuration drift.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written SOE policy document: Request to see the official guidelines for standard setups.
Look at
What software and configurations are mandated.
Good evidence
Involves a detailed policy listing specific software and versions with a last updated date.
- Check 2 of 5What an auditor asks for
Ask for
A list of computers and servers using the SOE: Request this list to verify compliance.
Look at
The percentage of systems that follow the standard setups.
Good evidence
Shows a high compliance rate with explanations for any exceptions.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of regular SOE updates: Request to see the schedule or record of updates.
Look at
How frequently updates have been applied.
Good evidence
Includes a recent and completed update log showing no gaps beyond the planned intervals.
- Check 4 of 5What an auditor asks for
Ask for
To see training materials or records for employee education on SOEs: Request records of past training sessions or materials distributed.
Look at
Evidence of regular and recent training.
Good evidence
Includes dated attendance records and training content reflecting current standards.
- Check 5 of 5What an auditor asks for
Ask for
Procurement procedures aligning with SOEs: Request documentation showing how procurement ensures compatibility with the SOE.
Look at
Clear steps or criteria that guide equipment purchases.
Good evidence
Shows consistent procurement practices tied directly to IT requirements.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1406 requires organisations to use SOEs for workstations and servers to ensure consistent, secure configurations. Annex A 8.9 requires configuration management across hardware, software, services and networks, including establishing, documenting, monitoring and reviewing configurations. An SOE is a specific configuration baseline and deployment approach within a broader configuration management regime, so ISM-1406 is a concrete subset of what Annex A 8.9 expects.
This control partially overlaps A.8.19.
ISM-1406 requires organisations to use Standard Operating Environments (SOEs) for workstations and servers to enforce consistent, secure baselines. Annex A 8.19 focuses on implementing secure procedures and measures for installing software onto operational systems, which is commonly implemented through controlled SOE build and deployment processes. The overlap is in standardised, controlled software deployment, but ISM-1406 is broader in covering the whole baseline environment (not just installation procedures) and applies explicitly to workstations and servers.
ASD Essential Eight: 2 mappings
This control supports E8-AH-ML2.9.
ISM-1406 requires organisations to use SOEs for workstations and servers to provide a consistent, controlled security baseline. E8-AH-ML2.9 requires PDF software to be securely configured using ASD and vendor hardening guidance, which can be embedded and enforced as part of an SOE build for endpoints and servers where applicable. ISM-1406 does not mandate PDF-specific hardening, but adopting SOEs makes it practical to deploy and maintain those hardened settings consistently.
This control supports E8-RA-ML3.2.
E8-RA-ML3.2 requires administrative activities to be performed only from Secure Admin Workstations (dedicated, hardened endpoints). ISM-1406 supports the creation and maintenance of such hardened endpoints by requiring Standard Operating Environments (SOEs) for workstations and servers. E8-RA-ML3.2 is about where/admin task segregation, while ISM-1406 is about baseline build standardisation across endpoints rather than admin-only usage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.