ASD ISM 1798 Develop secure configuration guidelines for software
What it says
Secure configuration guidance, in the form of a hardening guide or loosening guide, is produced and made available to consumers as part of software development.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishProvide users with guides to securely set up software configurations.
This control focuses on creating easy-to-follow guides for setting up software in a secure way. It's important because if software isn't configured securely, it could become an easy target for cybercriminals, leading to data breaches or system failures.
Free. Save your status, tasks and notes.
Why it matters
Without a published hardening/loosening guide, consumers may deploy insecure defaults or misconfigure the software, increasing exploitable attack surface and incidents.
How to implement
The IT team should develop secure configuration guides for each software used in the organisation.
Start by listing all software applications, then determine the safest settings for each. Use simple language and include screenshots where possible.
Managers should ensure that staff are trained on how to use the configuration guides.
Organise a workshop where an IT representative walks through setting up one common software using the guide. Encourage questions to ensure understanding.
Procurement should verify that newly purchased software comes with secure configuration instructions.
Before finalising a purchase, ask the vendor for their security configuration guide and review if it aligns with your internal security practices.
The IT team should review and update the secure configuration guides regularly.
Set a schedule to review guides quarterly, checking for any software updates or new security vulnerabilities, and revise the guide accordingly.
HR should include a segment on secure software configuration in the new employee onboarding process.
Create a checklist of essential softwares each new hire will use and ensure they know where to find and how to follow the configuration guides.
Keep it running
For each release, produce and publish a consumer-facing hardening/loosening guide with recommended settings, rationale, and verification steps; version and host it centrally.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current list of secure configuration guides: Request a document showing all available guides for the software used by the organisation.
Look at
The completeness and currency of the list.
Good evidence
Should show recent updates and cover all key software applications.
- Check 2 of 5What an auditor asks for
Ask for
To see documentation of training sessions on secure configurations: Request records of any training sessions conducted.
Look at
Participant lists, feedback forms, or session recordings.
Good evidence
Includes evidence of regular, well-attended training with positive feedback.
- Check 3 of 5What an auditor asks for
Ask for
Vendor-supplied configuration materials: Request materials that detail secure setups provided by software vendors.
Look at
Whether these are included in procurement records.
Good evidence
Includes materials that align with current software versions and organisational standards.
- Check 4 of 5What an auditor asks for
Ask for
The procedure for updating configuration guides: Request written procedures or policies detailing how guides are updated.
Look at
The roles responsible, frequency of updates, and methods for validation.
Good evidence
Clearly assigns accountability and describes a routine review process.
- Check 5 of 5What an auditor asks for
Ask for
Onboarding materials related to software configuration: Request sections of the onboarding manual or checklist that cover software configuration.
Look at
Specific references to the configuration guides and instructions.
Good evidence
Includes comprehensive and user-friendly onboarding documentation.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.1, Disable or remove Internet Explorer 11, which this control covers in full and more.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.25.
ISM-1798 requires that secure configuration guidance (hardening/loosening guides) is produced and made available to software consumers as part of software development. Annex A 8.25 requires an organisation to establish and apply rules for a secure development lifecycle across software and systems. Producing consumer hardening guidance is one concrete SDL activity, but Annex A 8.25 is broader and includes many other lifecycle practices beyond configuration guidance publication.
This control partially meets A.8.27.
ISM-1798 requires producing and publishing secure configuration (hardening/loosening) guides as part of software development. Annex A 8.27 requires establishing and applying secure system architecture and engineering principles across development activities. Configuration guidance for secure deployment is one expression of applying engineering principles, but Annex A 8.27 is broader and covers architectural design and engineering practices well beyond producing consumer configuration guides.
This control depends on A.8.9.
ISM-1798 requires publishing secure configuration guidance so consumers can securely configure the software. Annex A 8.9 requires configurations (including security configurations) to be established, documented, implemented, monitored and reviewed. ISM-1798 supports Annex A 8.9 by providing the vendor/developer guidance that helps an organisation document and implement secure baseline configurations, but Annex A 8.9 additionally covers ongoing monitoring and review which ISM-1798 does not.
ASD Essential Eight: 2 mappings
This control is broader than E8-AH-ML1.1.
ISM-1798 requires producing and providing secure configuration guidance for consumers as part of software development. E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed, which is a specific secure configuration/hardening outcome. The candidate is a single prescriptive control for one component, while ISM-1798 is broader and focuses on ensuring guidance exists for secure configuration across software.
This control is broader than E8-AH-ML3.3.
ISM-1798 requires secure configuration guidance to be produced and shared with software consumers. E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, which is a specific hardening configuration that would typically be described in a hardening guide. The candidate mandates an endpoint configuration outcome, while ISM-1798 is about ensuring the guidance exists (across software) rather than enforcing this particular PowerShell setting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.