ASD ISM 1409 Implement restrictive OS hardening guidelines
What it says
Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure operating systems follow strictest security guidelines from ASD or vendors.
This control is about making sure your computer systems are set up with the most secure settings available. It's important because if you don't use the strictest security settings, you leave the door open for hackers to get into your systems and cause harm, like stealing sensitive information or disrupting your business operations.
Free. Save your status, tasks and notes.
Why it matters
Without restrictive OS hardening baselines, insecure services and settings may be enabled, increasing attack surface and enabling unauthorised access.
How to implement
The IT team should review security guidelines from the Australian Signals Directorate (ASD) and the system's manufacturer to ensure your operating systems have the strongest possible security settings.
This involves checking for any updates to guidelines and applying them promptly.
System administrators should establish a routine to compare security settings between the ASD guidelines and the vendor's recommendations.
Where they differ, use the more restrictive setting to minimise security risks.
Managers should ensure the IT team has the resources and time to implement these strict security settings.
This might include buying software tools or allocating time for staff training.
IT teams should deploy automated tools to monitor compliance with these security settings continuously.
These tools can alert IT staff to any deviations from established security protocols.
System owners should document all security settings applied and any justifications for their choices, especially when deviating from recommended guidelines, ensuring clarity and accountability in security practices.
Keep it running
Regularly compare OS builds to ASD and vendor hardening baselines; when guidance conflicts, apply the most restrictive setting and document any exceptions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documentation showing the comparison between ASD and vendor security guidelines: Ensure the comparison regularly occurs.
Look at
How often this review happens and check the last review date.
Good evidence
Shows a consistent review process with clear justification for decisions made and the most restrictive settings applied.
- Check 2 of 5What an auditor asks for
Good evidence
Is a report showing all recommended settings are in place without exceptions.
- Check 3 of 5What an auditor asks for
Ask for
Logs or reports from automated compliance monitoring tools: Review if they show ongoing compliance and alert handling.
Good evidence
Is a log showing no or promptly resolved alerts.
- Check 4 of 5What an auditor asks for
Good evidence
Includes recent training sessions focusing on the security guidelines used.
- Check 5 of 5What an auditor asks for
Good evidence
Explains deviations with a strong justification supported by risk assessments.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML3.1, .NET Framework 3.5, 3.0, 2.0 is disabled or removed, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1409 requires organisations to implement hardened operating system configurations using ASD and vendor guidance, applying the most restrictive requirements where they conflict. Annex A 8.9 is broader because it requires configuration management across hardware, software, services and networks, including establishing, documenting, monitoring and reviewing configurations. ISM-1409 fits within Annex A 8.9 as a specific application of configuration management to OS hardening baselines and precedence rules.
This control partially overlaps A.8.19.
ISM-1409 requires operating systems to be hardened using ASD and vendor guidance, prioritising the most restrictive requirements. Annex A 8.19 overlaps by requiring secure procedures and measures for installing software on operational systems, which commonly includes enforcing hardened build images and controlled installation to preserve secure configurations. ISM-1409 is specifically focused on OS hardening baselines, while Annex A 8.19 is broader across software installation governance for all operational systems.
ASD Essential Eight: 4 mappings
This control is broader than E8-AH-ML3.1.
ISM-1409 requires operating systems to be hardened using ASD and vendor guidance, with the most restrictive requirements taking precedence. E8-AH-ML3.1 maps as a specific OS hardening measure by requiring Windows PowerShell 2.0 to be disabled or removed to reduce attack surface. ISM-1409 is broader because it covers all OS hardening settings and guidance precedence, while E8-AH-ML3.1 focuses on a single legacy component.
This control is broader than E8-AH-ML3.2.
ISM-1409 requires operating systems to be hardened in accordance with ASD and vendor hardening guidance, applying the most restrictive guidance when conflicts occur. E8-AH-ML3.2 is a specific hardening action (disabling/removing legacy .NET Framework versions) that would commonly be included within an OS hardening baseline on Windows. ISM-1409 is broader because it encompasses the full set of OS hardening requirements, while E8-AH-ML3.2 addresses one discrete configuration item.
This control is broader than E8-AH-ML3.3.
ISM-1409 requires operating systems to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. E8-AH-ML3.3 is a specific hardening configuration that constrains PowerShell capabilities (Constrained Language Mode), which is typically part of an ASD Windows hardening baseline. ISM-1409 is broader because it requires comprehensive OS hardening across settings, services and features, whereas E8-AH-ML3.3 addresses one control for scripting and execution behaviour.
This control is broader than E8-RA-ML3.4.
E8-RA-ML3.4 requires enabling memory integrity functionality as a specific hardening measure against exploitation. ISM-1409 requires operating systems to be hardened using ASD and vendor hardening guidance, which typically involves a wide range of security configuration settings across authentication, services, logging, and platform protections. Memory integrity may be included in such guidance, making E8-RA-ML3.4 a more specific requirement within the broader OS hardening approach of ISM-1409.
ASD Essentials for enterprise IT: 4 mappings
- IT.PRO-01.1Design systems with telemetry, least privilege, data protection and minimal attack surfacePartially overlaps
This control partially overlaps IT.PRO-01.1.
IT.PRO-01.1 requires secure system design that minimises privileges, limits exposed services and removes unnecessary functionality; ISM-1409 supports this for operating systems, hardening them with ASD and vendor guidance, with the most restrictive guidance prevailing in conflicts.
- IT.PRO-01.2Use secure build and deployment processes to enforce security controls consistentlyPartially overlaps
This control partially overlaps IT.PRO-01.2.
IT.PRO-01.2 requires secure build and deployment processes that enforce controls consistently across systems; ISM-1409 defines hardening that such processes can enforce for operating systems, using ASD and vendor guidance with the most restrictive taking precedence.
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines, informed by vendor and industry hardening guidance, that disable unnecessary services, insecure settings and weak protocols; ISM-1409 requires operating systems to be hardened using ASD and vendor guidance, overlapping on vendor-guided hardening without requiring approved baselines.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1409 applies this to operating systems, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.