ASD ISM 1408 Use 64-bit operating systems
What it says
64-bit versions of operating systems are used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure operating systems installed are 64-bit versions so they carry the security functionality that 32-bit builds lack.
Using 64-bit operating systems means your computers run the version of the operating system that carries the vendor's full set of built-in protections. When systems use the outdated 32-bit versions, they become more vulnerable to attacks because they can't make use of security features that only exist in 64-bit builds, such as kernel patch protection and mandatory signing of kernel-mode drivers on Windows, and the larger address space that makes address space layout randomisation (ASLR) far harder to defeat.
Free. Save your status, tasks and notes.
Why it matters
If this control is not followed and 32-bit systems are used, the organisation risks exposing itself to increased vulnerabilities. These systems lack security features present only in 64-bit versions (for example kernel patch protection, enforced kernel-mode driver signing and a large enough address space for effective ASLR), making them easier targets for attackers seeking to breach the network or compromise sensitive data.
How to implement
When setting up new computers, ensure the operating system you install is a 64-bit version.
You can find this option during the setup process of most operating system installations.
Before transitioning to a 64-bit system, make sure to inventory your current software and applications.
Verify that they support or have 64-bit versions to avoid compatibility issues.
For hardware devices, such as printers and scanners, confirm that there are 64-bit compatible drivers available.
Manufacturers often provide these on their websites or through automatic updates.
Set up a scheduled review process to ensure all systems are running 64-bit operating systems.
Include these checks during regular system maintenance tasks.
Update your procurement policy to specify that any new computers purchased must come with a pre-installed 64-bit operating system, ensuring future compatibility and security benefits.
Keep it running
Check every operating system in the fleet, including servers, workstations and standard operating environment (SOE) images, to confirm it is a 64-bit build, and treat any 32-bit instance found as an exception to be remediated. As new technology emerges, ensure that your procurement policy remains up-to-date to reflect this control's requirements, reinforcing the ongoing use of 64-bit operating systems. Additionally, anticipate and address any potential technical support or training needs that may arise as staff members transition to or maintain 64-bit systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the list of all current operating systems used in the organisation.
Look at
Examine the operating system information to confirm each system is listed as a 64-bit version.
Good evidence
All systems shown are running 64-bit versions of their respective operating systems, without any listed as 32-bit.
- Check 2 of 5What an auditor asks for
Ask for
Ask to observe a sample of servers and workstations and confirm the operating system architecture directly on each device.
Look at
Look at the system information output (for example systeminfo or the About page on Windows, or uname -m on Linux and macOS) to confirm the operating system reports a 64-bit architecture.
Good evidence
Every sampled device reports a 64-bit operating system, matching what the inventory records.
- Check 3 of 5What an auditor asks for
Ask for
Request the standard operating environment (SOE) or build images used to deploy operating systems.
Look at
Check the operating system architecture of each image and confirm no 32-bit images remain available for deployment.
Good evidence
All current build images are 64-bit versions of the operating system, and any 32-bit images have been retired.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the record of any 32-bit operating systems identified and how they were dealt with.
Look at
Check whether each identified 32-bit system was replaced or rebuilt with a 64-bit version, and how long that took.
Good evidence
Any 32-bit operating systems found were rebuilt or replaced with 64-bit versions, and none remain in use.
- Check 5 of 5What an auditor asks for
Ask for
Request evidence of regular audits for operating system types in use.
Look at
Review logs or reports from these audits proving all systems remain on 64-bit versions post initial deployment.
Good evidence
There is a periodic and consistent audit record showing that 64-bit operating systems are maintained without exception.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1408 requires organisations to use 64-bit versions of operating systems. This directly relates to ISO/IEC 27001:2022 Annex A 8.9 because selecting and enforcing a 64-bit OS standard is a defined security configuration decision that should be established as part of the organisation's secure configuration baseline and applied consistently. Annex A 8.9 is broader as it requires a managed lifecycle for configurations (document, implement, monitor, review) across many technology types, whereas ISM-1408 is one specific baseline requirement within that configuration set.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.