ASD ISM 1412 Web browser hardening with strict guidelines
What it says
Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWeb browsers must be set with the strictest security settings per ASD and vendor guides.
This control means that your web browser (the program you use to browse the internet) should have the highest level of security settings according to guidelines from both the Australian Signals Directorate (ASD) and the makers of the browser. This is crucial because if your web browser isn't secure, it can be an easy way for hackers to get into your computer, leading to data theft or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without ASD/vendor browser hardening (most restrictive applied), weak defaults can enable drive‑by attacks, credential theft and unauthorised data access via the browser.
How to implement
Business IT support should familiarise themselves with the Australian Government's guidelines and the browser manufacturer's security settings documentation.
Find the latest hardening guidelines from the ASD and the browser maker's official website, and compare them to ensure all recommended security settings are applied.
The IT team should customise web browser settings to the strictest standards, as per the ASD and manufacturer guidelines.
Go into the browser settings menu and adjust parameters such as enabling pop-up blockers and disabling auto-plugins to reduce security risks.
System owners should regularly update web browsers to ensure they have the most secure version.
Set up automatic updates within the browser settings and check periodically to verify the updates are proceeding without issues.
Managers should conduct regular discussions with staff on the importance of using hardened browsers.
Schedule monthly meetings or include it in existing meetings to remind staff about the reasons for these security measures and their own role in keeping systems safe.
The IT team should perform regular checks to confirm the hardened settings are intact and functioning as intended.
Use a checklist based on the ASD and browser guidelines to review each setting quarterly or after major browser updates.
Keep it running
Regularly audit browser policies against ASD and vendor baselines, applying the most restrictive setting where guidance conflicts, and rapidly update configs for new advisories.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the browser hardening policy document.
Look at
Whether it references both ASD guidelines and browser vendor recommendations.
Good evidence
Includes specific settings listed and a version control to show it's kept up to date.
- Check 2 of 5What an auditor asks for
Look at
Confirmation that features like pop-up blocking, script restrictions, and regular updates are enabled.
Good evidence
Is the settings being correctly configured according to both ASD and manufacturer guidelines.
- Check 3 of 5What an auditor asks for
Ask for
Records of recent browser update verification.
Look at
Logs or screenshots showing confirmation of the latest versions installed.
Good evidence
Would show frequent updates, ideally matching the release dates of browser updates.
- Check 4 of 5What an auditor asks for
Look at
Evidence of regular discussions about web browser security.
Good evidence
Would include records showing meetings discussing security updates at least monthly.
- Check 5 of 5What an auditor asks for
Ask for
IT team review records on browser settings.
Look at
A checklist that aligns with hardening guidelines and records of each item being checked off.
Good evidence
Includes dates of review, findings, and actions taken.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.1, Web browsers are hardened with the most restrictive guidance, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AH-ML2.1.
E8-AH-ML2.1 requires web browsers to be hardened using ASD and vendor hardening guidance, applying the most restrictive settings where guidance conflicts. ISM-1412 has similar requirements for web browsers, with the same rule that the most restrictive guidance takes precedence. Therefore, these controls can be considered interchangeable for compliance purposes.
This control is broader than E8-AH-ML1.4.
E8-AH-ML1.4 requires that web browser security settings are locked down so users cannot change them. ISM-1412 requires web browsers to be hardened using ASD and vendor guidance, which typically includes enforcing policies so users cannot relax security settings. E8-AH-ML1.4 covers only the lock-down aspect, whereas ISM-1412 addresses a broader hardening baseline across multiple browser security controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.