ASD ISM 1588 Annual review of standard operating environments
What it says
SOEs are reviewed and updated at least annually.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStandard Operating Environments must be reviewed and updated once every year.
Standard Operating Environments (SOEs) are like a set of rules for the software and systems used across your organisation. This annual review is important because it ensures everything is up-to-date and secure. If these rules are outdated, your organisation could be more vulnerable to cyber attacks, resulting in data breaches or loss of important information.
Free. Save your status, tasks and notes.
Why it matters
Outdated SOEs can expose systems to emerging threats, increasing the risk of breaches and compromising sensitive information.
How to implement
IT managers should schedule an annual review meeting.
Gather the IT team responsible for the organisation's digital infrastructure to discuss current SOEs. During the meeting, ensure the team checks for obsolete software and updates system settings to match the latest security standards.
System administrators should list all existing systems covered under the SOE.
Identify any systems that have been added or removed since the last review. This can be done by comparing current system inventories with the previous year's records.
The IT team should engage with software vendors.
Check if there are new updates or security patches available for the software currently used within the SOEs. This might involve logging into vendor portals or subscribing to update notifications.
HR should update the roles and responsibility matrix.
Ensure that the people responsible for maintaining the SOEs are still in the same roles or assign new people if roles have changed. Cross-check this matrix with the current team structure.
The compliance officer should document the review process.
Write down the steps carried out, findings from the review, and any updates applied. This documentation will serve as evidence in audits and help guide the next review cycle.
Keep it running
Conduct an annual SOE baseline review: validate patch levels, security hardening, and approved software; document changes and re-issue the SOE.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current system inventory report used during the SOE review.
Look at
The list of systems included in the review to confirm it's comprehensive and up-to-date.
Good evidence
Report includes all current systems with details like version numbers and last update dates.
- Check 2 of 5What an auditor asks for
Look at
The details of discussions regarding system updates and policy changes. Good minutes will show who attended, the issues discussed, decisions made, and any action items with assigned responsibilities.
- Check 3 of 5What an auditor asks for
Ask for
Records of communications with software vendors.
Look at
The updates or patches requested and received during the year.
Good evidence
Record would show timely requests and updated software version numbers, indicating proactivity in maintenance.
- Check 4 of 5What an auditor asks for
Look at
Clear assignment of roles for each SOE-related task.
Good evidence
Matrix will have recent date stamps and reflect any organisational changes, ensuring role accuracy for current team members.
- Check 5 of 5What an auditor asks for
Ask for
To see the documented SOE review process.
Look at
How the review was carried out, issues identified, and addressed updates. Good documentation is clear, detailed, and includes a timeline of changes made or decisions resolved during the review cycle.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1588 requires organisations to review and update Standard Operating Environments (SOEs) at least annually. Annex A 8.9 requires configurations (including security configurations) across hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, which includes reviewing endpoint/server baseline builds such as SOEs. ISM-1588 is a specific, time-bound subset focused on SOE baseline currency, whereas Annex A 8.9 is broader and applies to configuration management across many technology types and configurations beyond SOEs.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.