ASD ISM 1745 Enable security features for system protection
What it says
Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure essential security features are active to protect the system during startup.
This control is about activating security features on your computer systems before anything else starts up, to keep them safe and secure every time you turn them on. If these protections are not active, your system could be vulnerable to viruses or tampering before your usual defences kick in, putting your data and operations at risk.
Free. Save your status, tasks and notes.
Why it matters
If ELAM, Secure Boot, Trusted Boot and Measured Boot are not enabled, boot-time malware or rootkits can tamper with startup, bypassing defences and risking compromise.
How to implement
IT team should enable Secure Boot: Ensure this feature is turned on in the system's BIOS settings.
It allows the computer to verify that it only loads software that is trusted by the manufacturer.
IT team should activate Early Launch Antimalware: This involves configuring the system so that antivirus software starts before any other program.
Check the system settings to ensure the antivirus program is included in the startup sequence.
IT team should set up Trusted Boot: This ensures every component of the operating system loads correctly and is verified by a known source.
Use built-in system tools to verify and configure this setting.
IT team should implement Measured Boot: This records the boot sequence for audit purposes, creating a log to show what was loaded.
Confirm this feature is enabled in the system management settings to provide a detailed log post-startup.
System owner should regularly review these settings: Schedule regular check-ins with the IT team to ensure all these features are working as intended and up to date.
This can help catch and address new vulnerabilities early.
Keep it running
Periodically confirm ELAM, Secure Boot, Trusted Boot and Measured Boot are enabled in UEFI/OS, and review boot attestation or event logs for unexpected boot changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The system BIOS configuration report: Request documentation showing Secure Boot is enabled.
Look at
Confirmation that the system only allows authorised software to load.
Good evidence
A screenshot or report showing Secure Boot is active.
- Check 2 of 5What an auditor asks for
Ask for
To see the antivirus startup configuration: Request a demonstration or policy document showing Early Launch Antimalware is enabled.
Look at
The order of the startup applications.
Good evidence
Proof that antivirus software loads first before anything else.
- Check 3 of 5What an auditor asks for
Ask for
To review the system event log: Request the log file that records Trusted Boot activities.
Look at
Log entries confirming all system components verify successfully.
Good evidence
Consistent log entries showing trusted verification of each component.
- Check 4 of 5What an auditor asks for
Ask for
The Measured Boot report: Request access to boot sequence logs that show activity during startup.
Look at
Logs that verify what was loaded and when.
Good evidence
A detailed log showing the sequence of approved activities.
- Check 5 of 5What an auditor asks for
Ask for
Recent system audits or reports: Request any internal or external audits that examine these boot security settings.
Look at
Evidence that these settings have been reviewed and updates applied if needed.
Good evidence
A report with minimal or no discrepancies and dates of the last checks.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.7.
ISM-1745 requires boot-time security controls including Early Launch Antimalware and secure/trusted/measured boot to reduce the chance of compromise during startup. Annex A 8.7 requires organisations to implement protection against malware, which includes but is not limited to antimalware measures across the endpoint lifecycle. They overlap where Early Launch Antimalware contributes to malware protection before other controls load, but Annex A 8.7 also covers user awareness and broader malware controls not addressed by ISM-1745.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-RA-ML3.4.
E8-RA-ML3.4 requires memory integrity functionality to be enabled to reduce the likelihood of successful memory exploitation. ISM-1745 mandates boot-chain and early-start protections like Early Launch Antimalware, Secure Boot, Trusted Boot, and Measured Boot to ensure system integrity from startup. These controls complement each other in preventing low-level system compromises, though E8-RA-ML3.4 focuses on runtime memory protection while ISM-1745 focuses on boot and early-load integrity.
This control supports E8-RA-ML3.6.
E8-RA-ML3.6 requires enabling Credential Guard to isolate and protect stored credentials on Windows systems. ISM-1745 requires enabling boot and platform integrity features (Secure Boot, Trusted Boot, Measured Boot, and ELAM), which reduce the likelihood of pre-boot or early-boot compromise that could undermine credential protection mechanisms. These controls are not the same requirement, but ISM-1745 supports the trustworthiness of the platform that Credential Guard depends upon.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.