ASD ISM 1409Implement Restrictive OS Hardening Guidelines
Official control statement
Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure operating systems follow strictest security guidelines from ASD or vendors.
What this means in practice
This control is about making sure your computer systems are set up with the most secure settings available. It's important because if you don't use the strictest security settings, you leave the door open for hackers to get into your systems and cause harm, like stealing sensitive information or disrupting your business operations.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2023
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Operating system hardeningTopic
Hardening operating system configurations
Why it matters
Without restrictive OS hardening baselines, insecure services and settings may be enabled, increasing attack surface and enabling unauthorised access.
Operational notes
Regularly compare OS builds to ASD and vendor hardening baselines; when guidance conflicts, apply the most restrictive setting and document any exceptions.
Implementation tips
- The IT team should review security guidelines from the Australian Signals Directorate (ASD) and the system's manufacturer to ensure your operating systems have the strongest possible security settings. This involves checking for any updates to guidelines and applying them promptly.
- System administrators should establish a routine to compare security settings between the ASD guidelines and the vendor's recommendations. Where they differ, use the more restrictive setting to minimise security risks.
- Managers should ensure the IT team has the resources and time to implement these strict security settings. This might include buying software tools or allocating time for staff training.
- IT teams should deploy automated tools to monitor compliance with these security settings continuously. These tools can alert IT staff to any deviations from established security protocols.
- System owners should document all security settings applied and any justifications for their choices, especially when deviating from recommended guidelines, ensuring clarity and accountability in security practices.
Audit / evidence tips
- AskThe documentation showing the comparison between ASD and vendor security guidelines: Ensure the comparison regularly occursLook atHow often this review happens and check the last review dateGoodShows a consistent review process with clear justification for decisions made and the most restrictive settings applied
- GoodIs a report showing all recommended settings are in place without exceptions
- AskLogs or reports from automated compliance monitoring tools: Review if they show ongoing compliance and alert handlingGoodIs a log showing no or promptly resolved alerts
- GoodIncludes recent training sessions focusing on the security guidelines used
- GoodExplains deviations with a strong justification supported by risk assessments
Cross-framework mappings
How ISM-1409 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.9 | ISM-1409 requires organisations to implement hardened operating system configurations using ASD and vendor guidance, applying the most re... | |
sync_altPartially overlaps(1)expand_less | ||
| Annex A 8.19 | ISM-1409 requires operating systems to be hardened using ASD and vendor guidance, prioritising the most restrictive requirements | |
E8
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(4)expand_less | ||
| E8-AH-ML3.1 | ISM-1409 requires operating systems to be hardened using ASD and vendor guidance, with the most restrictive requirements taking precedence | |
| E8-AH-ML3.2 | ISM-1409 requires operating systems to be hardened in accordance with ASD and vendor hardening guidance, applying the most restrictive gu... | |
| E8-AH-ML3.3 | ISM-1409 requires operating systems to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where ... | |
| E8-RA-ML3.4 | E8-RA-ML3.4 requires enabling memory integrity functionality as a specific hardening measure against exploitation | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.