ASD ISM 1858 Implement strict IT equipment hardening guidelines
What it says
IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse the most restrictive security guidelines to secure IT equipment from unauthorised access.
This control is about making sure your computers and other IT equipment are as secure as possible by following strict security guidelines. It's important because if these guidelines aren't followed, your systems could be more vulnerable to hackers or unauthorised access, which can lead to data loss or other security breaches.
Free. Save your status, tasks and notes.
Why it matters
Failure to apply stringent ASD/vendor hardening guidelines could expose IT systems to unauthorised access, compromising sensitive data and operations.
How to implement
IT team should review the Australian Cyber Security Centre (ACSC) and vendor guidelines: Go through the detailed security recommendations provided by the ACSC and compare them with what the equipment vendors suggest.
Always choose the stricter option if there's a conflict.
Managers should ensure staff are trained in equipment security: Organise regular training sessions to make sure everyone understands the importance of following strict security guidelines and implementation steps.
The IT team should perform regular security audits: Create a schedule for checking that the security settings on all equipment comply with the most restrictive guidelines available.
Procurement should purchase compliant equipment: When buying new equipment, ensure it can meet and exceed the existing security guidelines, checking specifications against both ACSC and vendor guidance.
System owners should document all security settings: Keep a clear record of what hardening measures have been applied to each piece of equipment so there's no ambiguity in compliance.
Keep it running
Baseline builds on ASD and vendor hardening guides; validate regularly and, where guidance conflicts, apply the most restrictive settings and record exceptions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of equipment and applied security settings: Request a document detailing each piece of equipment and its current security configurations.
Look at
Adherence to the most recent ASD guidelines or stricter vendor guidelines.
Good evidence
Includes up-to-date configurations aligned with top security practices.
- Check 2 of 5What an auditor asks for
Ask for
Training materials and attendance records: Check the records for any training sessions done on IT security.
Look at
Topics covering ACSC and vendor guidelines and who attended the sessions. Good compliance shows regular training sessions with full staff participation.
- Check 3 of 5What an auditor asks for
Ask for
To see the audit schedule and reports: Review the audit schedule and records of past security audits. Look to see these audits are regular and comprehensive. Positive results should show consistent adherence to the strictest security guidelines.
- Check 4 of 5What an auditor asks for
Ask for
Procurement checklists used during purchasing: Evaluate the criteria used when buying new equipment. Ensure the checklist references ASD or stricter vendor guidelines. Good procurement practices include verification of security compliance before purchase.
- Check 5 of 5What an auditor asks for
Ask for
System documentation records: Inspect the documentation for detailed records of security measures applied to all equipment.
Look at
Clarity on the guidelines used and timestamps of updates. High standards are demonstrated by well-maintained records reflecting current high security settings.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML1.1, Disable or remove Internet Explorer 11, which this control covers in full and more.
ASD Essential Eight: 11 mappings
This control is broader than E8-AH-ML1.1.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance if there is a conflict. E8-AH-ML1.1 requires disabling or removing Internet Explorer 11, a specific hardening action aligned to reducing legacy browser attack surface. The candidate is a narrow, technology-specific hardening measure that would typically be implemented under the broader hardening expectations of ISM-1858.
This control is broader than E8-AH-ML2.2.
ISM-1858 requires organisations to harden IT equipment using ASD and vendor hardening guidance, applying the most restrictive guidance when conflicts occur. E8-AH-ML2.2 mandates a specific Microsoft Office hardening control (blocking Office from creating child processes) to reduce attack surface. The candidate is a specific subset of application hardening that would be implemented as part of meeting ISM-1858.
This control is broader than E8-AH-ML2.4.
ISM-1858 mandates hardening of IT equipment using ASD and vendor guidance, with the most restrictive guidance taking precedence. E8-AH-ML2.4 requires a specific Microsoft Office hardening setting (blocking Office from injecting code into other processes) that reduces exploit and lateral execution techniques. This candidate is narrower because it is one prescriptive configuration control within the broader equipment hardening program required by ISM-1858.
This control is broader than E8-AH-ML2.6.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, defaulting to the most restrictive guidance when conflicts occur. E8-AH-ML2.6 implements that same principle specifically for office productivity suites. This is a direct subset of ISM-1858 because it narrows the hardening scope to one application class.
This control is broader than E8-AH-ML2.7.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, taking the most restrictive guidance when conflicts occur. E8-AH-ML2.7 requires that office productivity suite security settings cannot be changed by users, which is a hardening governance measure enforcing configuration immutability. The candidate is narrower because it applies to one application class and one aspect of hardening (preventing user tampering) within the wider ISM-1858 requirement.
This control is broader than E8-AH-ML2.9.
ISM-1858 requires IT equipment to be hardened using ASD and vendor guidance, applying the most restrictive requirements where guidance conflicts. E8-AH-ML2.9 applies the same 'ASD + vendor, most restrictive wins' hardening rule but only for PDF software configuration. The candidate is therefore a specific subset of the primary's broader equipment hardening requirement.
This control is broader than E8-AH-ML2.10.
ISM-1858 requires organisations to harden IT equipment using ASD and vendor guidance, applying the most restrictive requirements when guidance conflicts. E8-AH-ML2.10 requires PDF software security settings to be immutable by users, enforcing a hardened configuration state for that software. This is a subset of ISM-1858 because it is limited to PDF software and focuses on preventing unauthorised configuration change.
This control is broader than E8-AH-ML3.2.
ISM-1858 requires IT equipment to be hardened in accordance with ASD and vendor guidance, prioritising the most restrictive requirements. E8-AH-ML3.2 requires disabling or removing Windows PowerShell 2.0, which is a concrete hardening action commonly present in ASD hardening guidance for Windows. The candidate is narrower because it addresses one specific control setting rather than the full hardening baseline across IT equipment.
This control is broader than E8-AH-ML3.3.
ISM-1858 requires hardening of IT equipment using ASD and vendor guidance, adopting the most restrictive configuration when guidance differs. E8-AH-ML3.3 requires configuring PowerShell to use Constrained Language Mode, which is a targeted hardening configuration reducing scripting abuse on endpoints. The candidate is a narrow, specific hardening requirement that fits within the broader hardening obligation of ISM-1858.
This control is broader than E8-RA-ML3.5.
ISM-1858 requires IT equipment to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. E8-RA-ML3.5 mandates enabling Local Security Authority (LSA) protection, which is a specific hardening configuration on Windows endpoints. This makes the candidate a specific subset implementation that would sit under the broader hardening expectations of ISM-1858.
This control partially meets E8-AH-ML2.1.
ISM-1858 mandates hardening of IT equipment using ASD and vendor guidance, taking the most restrictive position when guidance conflicts. E8-AH-ML2.1 applies this hardening approach to web browsers specifically, which are part of an organisation's IT environment. The candidate is narrower in scope because it focuses on one software category rather than all IT equipment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.