ASD ISM 1493Maintain and Verify Software Registers
Official control statement
Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure software lists for all IT equipment are up-to-date and regularly checked.
What this means in practice
This control is about keeping a detailed and accurate list of all the software running on your computers and other devices. It's important because if you don't know what software you have, you're likely to miss important updates and patches, which can leave your systems open to attacks.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
Without an accurate software register, your company might miss critical updates, increasing the risk of hacking or data breaches.
Operational notes
Regularly review and update the software register. Consistent monitoring ensures new software is correctly documented and validated.
Implementation tips
- System owners should compile a list of all software currently installed on company devices. Use basic inventory tools, checking regularly to add or remove software as it changes.
- The IT team should coordinate regular updates of this list. This might involve setting reminders in their calendars to check for new installations or removals once a month.
- Managers should ensure there is a policy in place that requires any new software to be reported before installation. This can be a simple form or email notification to the IT department.
- An office manager should consider establishing a process for verifying software updates are applied. This can involve checking a sample of computers every few weeks and confirming with users.
- Procurement should maintain records of all software licenses purchased. This ensures that the list is consistent with current licenses and helps control costs.
Audit / evidence tips
- AskAsk for the software register covering workstations, servers, network devices and networked IT equipment.Look atVerify that it records software names, versions and installation dates for each asset type.GoodA comprehensive register with no gaps across the asset types in scope.
- AskRequest records of regular updates to the software register, such as monthly change logs.Look atCheck the records for consistency and the dates on which updates were made.GoodRegular and timely updates are noted, showing the register is actively maintained.
- AskAsk for evidence of the review process for new software installations.Look atLook for documented requests or approvals for new software and confirm they flow through to the register.GoodA reliable approval trail exists and approved installations appear in the register.
- AskRequest meeting notes or reports from periodic system checks that verify the register against installed software.Look atLook for any discrepancies noted during verification and the actions taken to resolve them.GoodDiscrepancies are identified and closed out, showing proactive management of software changes.
- AskAsk for the list of software licences held by the organisation.Look atCheck the licence list against the software register to identify any unauthorised or unlicensed software.GoodNo discrepancies between the licence list and the software register.
Cross-framework mappings
How ISM-1493 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(2)expand_less | ||
| Annex A 5.9 | Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including owners | |
| Annex A 8.19 | ISM-1493 requires organisations to develop, maintain and verify software registers, ensuring installed software is known and can be check... | |
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 4.5 | Annex A 4.5 requires documentation of the system and computing resources utilised for an AI system | |
E8
| Control | Notes | Details |
|---|---|---|
handshakeSupports(2)expand_less | ||
| E8-AC-ML3.1 | ISM-1493 requires organisations to maintain and regularly verify software registers for servers and other networked equipment, identifyin... | |
| E8-PA-ML3.3 | ISM-1493 requires organisations to maintain and verify software registers so they can reliably identify installed applications and their ... | |
extensionDepends on(2)expand_less | ||
| E8-AC-ML1.1 | ISM-1493 requires organisations to maintain and regularly verify software registers across devices, creating visibility of what executabl... | |
| E8-PO-ML1.1 | E8-PO-ML1.1 focuses on discovering assets automatically at least fortnightly to enable effective vulnerability scanning coverage | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System management
See all Guidelines for system management controls, or browse the full ASD ISM library.