ASD ISM 1860Harden PDF Applications Using ASD Guidance
Official control statement
PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure PDF applications are securely configured following official security guidelines.
What this means in practice
Setting up PDF software to follow strict security rules is essential to protect sensitive information. If not configured properly, these applications could be a gateway for cyber criminals to access your important documents and data.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML2, ML3
Guideline
Guidelines for system hardeningSection
User application hardeningTopic
Portable Document Format applications
Why it matters
If PDF applications are not hardened per ASD and vendor guidance, attackers may exploit PDF features to run code or exfiltrate sensitive documents.
Operational notes
Periodically compare ASD and vendor PDF hardening guides, apply the most restrictive settings (e.g., JavaScript/macros, plugins, sandboxing), and verify after updates.
Implementation tips
- The IT manager should review the Australian Signals Directorate's (ASD) guidelines and the software vendor's security settings for PDF applications. They should identify the most restrictive settings provided by both and ensure those are applied to reduce risk.
- The system administrator should configure the PDF application settings according to the compiled list of most restrictive security settings. This might involve enabling password protection, disabling features that allow documents to run scripts, and ensuring automatic updates are turned on.
- The IT team should perform regular checks to confirm that all PDF applications remain compliant with the ASD and vendor guidelines. This can be done by using a checklist to verify that the security settings have not been altered or reverted.
- Procurement officers should ensure that any new PDF software purchased allows for the configurations specified by the ASD guidelines. This includes checking compatibility with security features before purchase.
- The IT support team should provide training to staff on recognising signs of malicious PDFs, such as unexpected pop-ups or requests for sensitive information. Training sessions can include examples and quick quizzes to ensure understanding.
Audit / evidence tips
- AskThe document that outlines the PDF application hardening settings: Request a report from the IT manager that details how the ASD and vendor guidelines are implementedLook atThe specific settings applied to ensure they follow the most restrictive advice
- Look atA review schedule and notes on any actions taken as a result
- AskUser training recordsLook atAttendance logs and training materials to confirm staff received guidance on handling PDFs securelyGoodIncludes dated records and feedback forms showing employee participation
- AskTo see the procurement checklist for PDF applications: It should include reviewing security feature compatibility. Successful records have descriptions of tested features and any compliance check with the ASD guidelines
Cross-framework mappings
How ISM-1860 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.9 | ISM-1860 requires hardening of PDF applications using ASD and vendor guidance, prioritising the most restrictive settings | |
E8
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| E8-AH-ML2.9 | ISM-1860 requires PDF applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where c... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.