ISM-1604policyASD Information Security Manual (ISM)

Harden Software Isolation Mechanisms Sharing Physical Computing Resources

A software-based isolation mechanism is software (such as a hypervisor or container engine) that lets multiple workloads share the same physical computing resources (the same processor, memory and storage) while keeping them separated from each other. Because everything runs on shared hardware, a weakness in this software could let one workload reach another's data or take over the underlying system. This control requires you to harden the isolation mechanism's configuration in two specific ways. First, remove any functionality that is not needed, so there are fewer features an attacker could exploit. Second, restrict access to the administrative interface (the management console or controls used to configure and run the isolation mechanism) so that only authorised people can change how it works.

Preventative NC OS PASD Information Security ManualGuidelines for system hardening Hardening Access control

record_voice_over

Plain language

When you run several systems on the same physical machine, special software keeps them apart so they cannot interfere with each other. This software has to be locked down. There are two things to do. The first is to turn off any features the software offers that your business does not actually use, because every switched-on feature is something an attacker could try to misuse. The second is to make sure that only trusted, authorised staff can reach the management controls that configure the software. If you leave unused features running, or let too many people into the management controls, an attacker could break out of one system, reach data that belongs to another, or take over the whole shared machine.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2026

Control Stack last updated

18 June 2026

E8 maturity levels

N/A

Guideline

Guidelines for system hardening

Section

Virtualisation Hardening

Topic

Functional Separation Between Operating Environments

Official control statement

When using a software-based isolation mechanism that consumes shared physical computing resources, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism.

policyASD Information Security Manual (ISM)ISM-1604

priority_high

Why it matters

If unused features stay enabled or too many people reach the management controls, an attacker could break out of one workload, read another's data, or take over the shared machine.

settings

Operational notes

Re-check the live configuration against the hardened baseline on a set schedule, since updates or new workloads can re-enable removed features or widen admin access.

02 - Implement

build

Implementation tips

System administrators should produce a baseline configuration for the isolation mechanism (for example the hypervisor or container engine) that lists every feature, service and capability it offers, then disable everything not required for business use.
The platform team should turn off optional functions that are commonly unused on shared-resource isolation software, such as unnecessary device pass-through, clipboard or file sharing between guests, legacy network services, and unused management plugins or APIs.
Identity administrators should restrict the administrative interface so only named, authorised individuals can reach it, using role-based access so each person has only the management rights their job needs.
Network engineers should place the administrative interface on a separate, controlled management network and block it from general user networks and the internet, so the controls cannot be reached from where workloads run.
The configuration owner should record each hardening change with the reason it was made, and re-check the live configuration against the hardened baseline on a set schedule so removed features are not quietly re-enabled.

03 - Audit

fact_check

Audit / evidence tips

Askthe team to name the software-based isolation mechanisms that share physical computing resources and to show the hardened configuration baseline for eachLook ata documented list of features with unneeded ones marked disabled and a reason recordedGoodpairs each removed feature with its business justification and a date
Askhow they decided which functionality was unneededLook ata feature-by-feature review against business requirements rather than default vendor settings left in placeGoodreferences a vendor hardening guide or benchmark and shows defaults that were deliberately turned off
Askwho can reach the administrative interface and how access is grantedLook ata short list of named, authorised administrators with role-based permissionsGoodshows access is limited by role and that general users and unused accounts cannot reach the management controls
Askhow the administrative interface is protected from being reached by ordinary workloads or external networksLook atnetwork separation, firewall rules or an isolated management networkGooddemonstrates the interface is unreachable from user and guest networks
Askhow they confirm the hardening stays in place over timeLook atperiodic checks comparing the live configuration against the hardened baselineGoodshows dated review records and evidence that any drift (re-enabled features or added admin access) was corrected

04 - Mappings

link

Cross-framework mappings

How ISM-1604 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(3)expand_less
Annex A 5.15	ISM-1604 requires hardening of the virtual server isolation mechanism and restricting access to the administrative interface used to mana...
Annex A 8.3	ISM-1604 requires hardening of the virtual isolation mechanism and restricting access to its administrative interface
Annex A 8.9	ISM-1604 requires a hardened configuration for the software-based isolation mechanism, including removing unneeded functionality and rest...
handshakeSupports(3)expand_less
Annex A 5.18	ISM-1604 requires that access to the administrative interface of the software isolation mechanism is restricted as part of hardening
Annex A 8.2	ISM-1604 requires restricting access to the administrative interface used to manage the isolation mechanism, reducing who can administer ...
Annex A 8.20	ISM-1604 requires hardening the virtualisation/isolation mechanism and restricting administrative interface access, which often includes ...

E8

Control	Notes	Details
handshakeSupports(2)expand_less
E8-RA-ML2.4	ISM-1604 requires the administrative interface for the isolation mechanism (e.g
E8-RA-ML3.3	ISM-1604 requires the virtualisation/isolation mechanism to be hardened by removing unneeded functionality and restricting access to the ...