ASD ISM 1859 Hardening Office productivity suites
What it says
Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecure your office apps using the strictest guidance from ASD and vendors to keep your data safe.
Hardening your office productivity software, like Microsoft Office or Google Workspace, is about setting up these tools to be as secure as possible. It's important because if your office software is not properly secured, it can become a backdoor for hackers, putting sensitive data and business operations at risk.
Free. Save your status, tasks and notes.
Why it matters
If office productivity suites are not hardened, attackers can exploit macros, add-ins or document handling to execute code and exfiltrate sensitive data.
How to implement
IT team should follow security guidelines: The IT team should closely follow security hardening guides from both the Australian Signals Directorate (ASD) and the software vendors.
They can find these guides on the ASD website and from the software vendors' resources, and must apply the strictest recommendations even if they are tough to implement.
Office managers should ensure software is updated: Office managers need to make sure that all office productivity software is regularly updated to the latest versions.
This involves setting up automatic updates or scheduling a regular time each month for manual updates, ensuring security patches are applied promptly.
System owners should collaborate with users: System owners should work with employees to identify which security settings may impact their workflow and find a balance.
They can do this by organising workshops to discuss workflow needs while still maintaining security compliance.
Managers should develop a hardening policy: Managers should create a clear policy on how office software should be configured and maintained securely.
They can draft this by consulting both ASD guidelines and industry best practices, making sure to document this policy clearly and distribute it among staff.
Procurement should buy compliant software: Procurement teams should ensure any new software purchases comply with security guidelines from ASD and the vendors.
This includes asking vendors for documentation on their compliance with security standards before making a purchase.
Keep it running
Regularly update office suite hardening settings to match latest ASD/vendor guidance; monitor for security customisation drift.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The security settings documentation: Request the document detailing the security settings applied to each office productivity suite in use.
Look at
The settings to ensure they match the recommended standards from ASD and the software vendor.
Good evidence
Settings documentation that lists strict security measures and compliance with the strictest guidelines.
- Check 2 of 5What an auditor asks for
Ask for
To see patch management records: Request records of software updates and patches applied to the office suites.
Look at
Regular and timely updates that align with vendor releases.
Good evidence
Detailed logs showing updates have been applied within a reasonable timeframe after release.
- Check 3 of 5What an auditor asks for
Ask for
Documentation of any workshops or training sessions held to educate staff on software security settings.
Look at
Participation records and feedback from attendees.
Good evidence
Records showing regular training sessions with positive feedback on understanding and compliance.
- Check 4 of 5What an auditor asks for
Ask for
Compliance reports: Request reports or audits that verify compliance with ASD and vendor guidelines.
Look at
The audit results to ensure they indicate all security controls are effectively implemented.
Good evidence
Recent audit reports showing full compliance or documented plans for addressing any gaps.
- Check 5 of 5What an auditor asks for
Ask for
Records that show how new software purchases were evaluated for security compliance.
Look at
Decision-making processes and checklists used during procurement.
Good evidence
Detailed procurement criteria including security compliance factors being checked and approved.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.6, Office productivity suites are hardened using ASD and vendor guidance, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-AH-ML2.6.
ISM-1859 requires office productivity suites to be hardened using ASD and vendor hardening guidance, applying the most restrictive settings where guidance conflicts. E8-AH-ML2.6 states the same requirement with the same decision rule (most restrictive precedence) for the same technology scope. Implementing either control would largely satisfy the other for office productivity suite hardening.
This control is broader than E8-AH-ML2.2.
ISM-1859 requires organisations to harden office productivity suites in line with ASD and vendor guidance, applying the most restrictive settings where required. E8-AH-ML2.2 mandates one specific hardening configuration for Microsoft Office: blocking Office from creating child processes. This is a subset technique that can be used to meet ISM-1859, but ISM-1859 also expects broader suite hardening beyond this single mitigation.
This control is broader than E8-AH-ML2.7.
ISM-1859 requires office productivity suites to be hardened using ASD and vendor guidance, choosing the most restrictive configuration when there is a conflict. E8-AH-ML2.7 is a specific hardening outcome requiring those suite security settings to be enforced so users cannot change them. ISM-1859 encompasses this immutability as one possible hardening requirement, but also covers many other hardening settings beyond user immutability.
This control partially overlaps E8-AH-ML2.9.
E8-AH-ML2.9 requires PDF software to be hardened using ASD and vendor guidance, prioritising the most restrictive settings. ISM-1859 requires hardening of office productivity suites using the same guidance approach, which may include PDF-handling components in some suites but is not necessarily limited to dedicated PDF software. They overlap on the common method (ASD/vendor hardening and conflict resolution), but their application scope differs (PDF software specifically vs broader office suites).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.