What does ASD ISM 1408 require?

policyASD Information Security Manual (ISM)

ASD ISM 1408Use 64-bit Operating Systems

Official control statement

64-bit versions of operating systems are used.

policyASD Information Security Manual (ISM)ISM-1408

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Ensure operating systems installed are 64-bit versions so they carry the security functionality that 32-bit builds lack.

NC OS PASD Information Security ManualGuidelines for system hardening

Control Stack classificationPreventative Hardening

record_voice_over

What this means in practice

Using 64-bit operating systems means your computers run the version of the operating system that carries the vendor's full set of built-in protections. When systems use the outdated 32-bit versions, they become more vulnerable to attacks because they can't make use of security features that only exist in 64-bit builds, such as kernel patch protection and mandatory signing of kernel-mode drivers on Windows, and the larger address space that makes address space layout randomisation (ASLR) far harder to defeat.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2026

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for system hardening

Section

Operating system hardening

Topic

Operating system releases and versions

priority_high

Why it matters

If this control is not followed and 32-bit systems are used, the organisation risks exposing itself to increased vulnerabilities. These systems lack security features present only in 64-bit versions (for example kernel patch protection, enforced kernel-mode driver signing and a large enough address space for effective ASLR), making them easier targets for attackers seeking to breach the network or compromise sensitive data.

settings

Operational notes

Check every operating system in the fleet, including servers, workstations and standard operating environment (SOE) images, to confirm it is a 64-bit build, and treat any 32-bit instance found as an exception to be remediated. As new technology emerges, ensure that your procurement policy remains up-to-date to reflect this control's requirements, reinforcing the ongoing use of 64-bit operating systems. Additionally, anticipate and address any potential technical support or training needs that may arise as staff members transition to or maintain 64-bit systems.

02 - Implement

build

Implementation tips

When setting up new computers, ensure the operating system you install is a 64-bit version. You can find this option during the setup process of most operating system installations.
Before transitioning to a 64-bit system, make sure to inventory your current software and applications. Verify that they support or have 64-bit versions to avoid compatibility issues.
For hardware devices, such as printers and scanners, confirm that there are 64-bit compatible drivers available. Manufacturers often provide these on their websites or through automatic updates.
Set up a scheduled review process to ensure all systems are running 64-bit operating systems. Include these checks during regular system maintenance tasks.
Update your procurement policy to specify that any new computers purchased must come with a pre-installed 64-bit operating system, ensuring future compatibility and security benefits.

03 - Audit

fact_check

Audit / evidence tips

AskRequest the list of all current operating systems used in the organisation.Look atExamine the operating system information to confirm each system is listed as a 64-bit version.GoodAll systems shown are running 64-bit versions of their respective operating systems, without any listed as 32-bit.
AskAsk to observe a sample of servers and workstations and confirm the operating system architecture directly on each device.Look atLook at the system information output (for example systeminfo or the About page on Windows, or uname -m on Linux and macOS) to confirm the operating system reports a 64-bit architecture.GoodEvery sampled device reports a 64-bit operating system, matching what the inventory records.
AskRequest the standard operating environment (SOE) or build images used to deploy operating systems.Look atCheck the operating system architecture of each image and confirm no 32-bit images remain available for deployment.GoodAll current build images are 64-bit versions of the operating system, and any 32-bit images have been retired.
AskAsk for the record of any 32-bit operating systems identified and how they were dealt with.Look atCheck whether each identified 32-bit system was replaced or rebuilt with a 64-bit version, and how long that took.GoodAny 32-bit operating systems found were rebuilt or replaced with 64-bit versions, and none remain in use.
AskRequest evidence of regular audits for operating system types in use.Look atReview logs or reports from these audits proving all systems remain on 64-bit versions post initial deployment.GoodThere is a periodic and consistent audit record showing that 64-bit operating systems are maintained without exception.