ASD ISM 1743 Choose secure operating system vendors
What it says
Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for operating systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChoose OS vendors who prioritise secure design and memory-safe languages or practices.
When selecting an operating system for your devices, you should choose providers who put a strong emphasis on security from the ground up. This is important because if an operating system has vulnerabilities, it can be exploited by cybercriminals to access sensitive information, disrupt operations, or even damage your business's reputation.
Free. Save your status, tasks and notes.
Why it matters
Choosing OS vendors committed to Secure by Design/Default and memory-safe development reduces OS flaws that enable compromise, data loss and service disruption.
How to implement
The procurement manager should choose operating system vendors that have a strong reputation for security.
They can do this by reading up on vendor reviews and reports or consulting with cyber security experts to ensure the vendor uses secure programming practices.
The IT team should evaluate operating systems for their security features before acquisition.
They can conduct tests or pilot programs on a small scale to confirm the operating system uses memory-safe techniques, reducing potential security risks from software bugs.
System administrators should follow vendor updates and security bulletins after choosing an operating system.
This involves subscribing to vendor notifications to stay informed about security patches and applying them promptly to maintain system safety.
The IT security team should establish criteria for operating system selection that includes secure design and memory-safe practices.
This involves drafting a checklist of essential security features based on trusted security guidelines, such as the Australian Cyber Security Centre recommendations.
Business owners should consult with a cyber security consultant periodically to reassess which operating systems are most secure.
This involves scheduling annual reviews to discuss advancements in technology and whether current systems still meet security needs.
Keep it running
Periodically review OS vendor Secure by Design/Default evidence, track language/memory-safety posture, and prefer vendors with secure SDLC and timely security fixes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documentation detailing the criteria used for operating system selection.
Look at
The security features like secure design and memory-safe programming.
Good evidence
Includes a comprehensive checklist aligned with ASD (Australian Signals Directorate) security benchmarks.
- Check 2 of 5What an auditor asks for
Good evidence
Show evaluations using clear, security-focused criteria and decision justifications.
- Check 3 of 5What an auditor asks for
Ask for
Records of operating system security updates and patches applied.
Look at
The dates and type of updates received and applied.
Good evidence
Shows prompt application of critical patches as soon as they are available, ensuring minimal exposure to vulnerabilities.
- Check 4 of 5What an auditor asks for
Look at
How often these reviews are conducted and the findings reported.
Good evidence
Demonstrates regular review cycles and adjustments as required by updated security practices.
- Check 5 of 5What an auditor asks for
Ask for
The records of consultations with cyber security experts or consultants.
Look at
The recommendations provided and any actions taken in response.
Good evidence
Includes documentation of advice implemented to enhance operating system security.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.21.
ISM-1743 requires organisations to choose operating system vendors that demonstrate Secure by Design/Secure by Default practices and prefer memory-safe languages or practices. ISO/IEC 27001:2022 Annex A 5.21 requires managing information security risks across the broader ICT supply chain, which includes selecting and assuring vendors for ICT products such as operating systems. ISM-1743 is a specific supply-chain requirement focused on OS vendor security engineering maturity, whereas Annex A 5.21 covers a wider set of supply chain risk processes and product/service types.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.