ASD ISM 1493 Maintain and verify software registers
What it says
Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure software lists for all IT equipment are up-to-date and regularly checked.
This control is about keeping a detailed and accurate list of all the software running on your computers and other devices. It's important because if you don't know what software you have, you're likely to miss important updates and patches, which can leave your systems open to attacks.
Free. Save your status, tasks and notes.
Why it matters
Without an accurate software register, your company might miss critical updates, increasing the risk of hacking or data breaches.
How to implement
System owners should compile a list of all software currently installed on company devices.
Use basic inventory tools, checking regularly to add or remove software as it changes.
The IT team should coordinate regular updates of this list.
This might involve setting reminders in their calendars to check for new installations or removals once a month.
Managers should ensure there is a policy in place that requires any new software to be reported before installation.
This can be a simple form or email notification to the IT department.
An office manager should consider establishing a process for verifying software updates are applied.
This can involve checking a sample of computers every few weeks and confirming with users.
Procurement should maintain records of all software licenses purchased.
This ensures that the list is consistent with current licenses and helps control costs.
Keep it running
Regularly review and update the software register. Consistent monitoring ensures new software is correctly documented and validated.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the software register covering workstations, servers, network devices and networked IT equipment.
Look at
Verify that it records software names, versions and installation dates for each asset type.
Good evidence
A comprehensive register with no gaps across the asset types in scope.
- Check 2 of 5What an auditor asks for
Ask for
Request records of regular updates to the software register, such as monthly change logs.
Look at
Check the records for consistency and the dates on which updates were made.
Good evidence
Regular and timely updates are noted, showing the register is actively maintained.
- Check 3 of 5What an auditor asks for
Ask for
Ask for evidence of the review process for new software installations.
Look at
Look for documented requests or approvals for new software and confirm they flow through to the register.
Good evidence
A reliable approval trail exists and approved installations appear in the register.
- Check 4 of 5What an auditor asks for
Ask for
Request meeting notes or reports from periodic system checks that verify the register against installed software.
Look at
Look for any discrepancies noted during verification and the actions taken to resolve them.
Good evidence
Discrepancies are identified and closed out, showing proactive management of software changes.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the list of software licences held by the organisation.
Look at
Check the licence list against the software register to identify any unauthorised or unlicensed software.
Good evidence
No discrepancies between the licence list and the software register.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.9.
Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including owners. ISM-1493 (Ensure Regular Updates of Software Registers) overlaps by requiring registers of installed software to be developed, maintained, and verified. However, ISM-1493 covers only software.
This control partially overlaps A.8.19.
ISM-1493 requires organisations to develop, maintain and verify software registers, ensuring installed software is known and can be checked for accuracy. Annex A 8.19 requires procedures and measures to securely manage software installation on operational systems, which typically includes ensuring only authorised software is installed and installations are traceable. They overlap where software registers are used to verify installation compliance and detect unauthorised software, but Annex A 8.19 is primarily about controlling the installation process while ISM-1493 is about maintaining and verifying the record of installed software.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.4.5.
Annex A 4.5 requires documentation of the system and computing resources utilised for an AI system. ISM-1493 mandates developed, maintained and verified software registers for workstations, servers, network devices and networked IT equipment, which directly documents software components (e.g., operating systems, runtimes, supporting services) that may be part of the AI system’s computing stack. ISM-1493 does not require linking software entries to a specific AI system, whereas Annex A 4.5 is specifically about documenting the resources used by a given AI system.
ASD Essential Eight: 4 mappings
This control supports E8-AC-ML3.1.
ISM-1493 requires organisations to maintain and regularly verify software registers for servers and other networked equipment, identifying what software is installed. E8-AC-ML3.1 requires application control on non-internet-facing servers, which benefits from accurate knowledge of installed/required applications to define permitted execution. ISM-1493 supports E8-AC-ML3.1 by enabling validation that only approved software exists on servers, but E8-AC-ML3.1 focuses on preventing execution rather than maintaining an inventory.
This control supports E8-PA-ML3.3.
ISM-1493 requires organisations to maintain and verify software registers so they can reliably identify installed applications and their support status. E8-PA-ML3.3 requires unsupported applications (with noted exclusions) to be removed, which depends on being able to identify where unsupported applications exist. ISM-1493 supports E8-PA-ML3.3 by enabling detection and verification of unsupported software across the fleet, but E8-PA-ML3.3 is a remediation requirement rather than a register maintenance requirement.
This control depends on E8-AC-ML1.1.
ISM-1493 requires organisations to maintain and regularly verify software registers across devices, creating visibility of what executables/applications are present. E8-AC-ML1.1 requires application control to be implemented on workstations, which relies on defining and maintaining an understanding of authorised versus unauthorised software. ISM-1493 supports E8-AC-ML1.1 by providing the evidence base to build, validate and review allow lists, though application control is an enforcement mechanism that goes beyond maintaining a register.
This control depends on E8-PO-ML1.1.
E8-PO-ML1.1 focuses on discovering assets automatically at least fortnightly to enable effective vulnerability scanning coverage. ISM-1493 requires software registers to be developed, maintained and verified, which helps identify what software exists on discovered assets and supports scoping and prioritisation for subsequent vulnerability scanning and remediation. ISM-1493 is about maintaining register accuracy rather than performing automated discovery at a defined frequency.
ASD Essentials for enterprise IT: 2 mappings
- IT.IDE-01.1Use an approved inventory with automated discovery of new and changed assetsPartially overlaps
This control partially overlaps IT.IDE-01.1.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; ISM-1493 overlaps on software assets, requiring maintained and regularly verified software registers for workstations, servers, network devices and networked IT equipment.
- IT.IDE-01.2Keep current records of infrastructure, software, identities, credentials and dataPartially overlaps
This control partially overlaps IT.IDE-01.2.
IT.IDE-01.2 requires current records of infrastructure, operating systems, applications, identities, credentials and data assets; ISM-1493 covers the software part, requiring software registers for workstations, servers, network devices and networked IT equipment to be maintained and regularly verified.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.