ASD ISM 1860 Harden PDF applications using ASD guidance
What it says
PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure PDF applications are securely configured following official security guidelines.
Setting up PDF software to follow strict security rules is essential to protect sensitive information. If not configured properly, these applications could be a gateway for cyber criminals to access your important documents and data.
Free. Save your status, tasks and notes.
Why it matters
If PDF applications are not hardened per ASD and vendor guidance, attackers may exploit PDF features to run code or exfiltrate sensitive documents.
How to implement
The IT manager should review the Australian Signals Directorate's (ASD) guidelines and the software vendor's security settings for PDF applications.
They should identify the most restrictive settings provided by both and ensure those are applied to reduce risk.
The system administrator should configure the PDF application settings according to the compiled list of most restrictive security settings.
This might involve enabling password protection, disabling features that allow documents to run scripts, and ensuring automatic updates are turned on.
The IT team should perform regular checks to confirm that all PDF applications remain compliant with the ASD and vendor guidelines.
This can be done by using a checklist to verify that the security settings have not been altered or reverted.
Procurement officers should ensure that any new PDF software purchased allows for the configurations specified by the ASD guidelines.
This includes checking compatibility with security features before purchase.
The IT support team should provide training to staff on recognising signs of malicious PDFs, such as unexpected pop-ups or requests for sensitive information.
Training sessions can include examples and quick quizzes to ensure understanding.
Keep it running
Periodically compare ASD and vendor PDF hardening guides, apply the most restrictive settings (e.g., JavaScript/macros, plugins, sandboxing), and verify after updates.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The document that outlines the PDF application hardening settings: Request a report from the IT manager that details how the ASD and vendor guidelines are implemented.
Look at
The specific settings applied to ensure they follow the most restrictive advice.
- Check 2 of 4What an auditor asks for
Look at
A review schedule and notes on any actions taken as a result.
- Check 3 of 4What an auditor asks for
Ask for
User training records.
Look at
Attendance logs and training materials to confirm staff received guidance on handling PDFs securely.
Good evidence
Includes dated records and feedback forms showing employee participation.
- Check 4 of 4What an auditor asks for
Ask for
To see the procurement checklist for PDF applications: It should include reviewing security feature compatibility. Successful records have descriptions of tested features and any compliance check with the ASD guidelines.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.9, Ensure PDF software is securely configured using guidance., which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1860 requires hardening of PDF applications using ASD and vendor guidance, prioritising the most restrictive settings. Annex A 8.9 requires security configurations for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. ISM-1860 is a specific instance of configuration management focused on one application class (PDF applications) and does not on its own cover the full lifecycle governance elements (e.g. monitoring/review) across all assets.
ASD Essential Eight: 1 mapping
This control is equivalent to E8-AH-ML2.9.
ISM-1860 requires PDF applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive guidance where conflicts occur. E8-AH-ML2.9 states the same requirement for PDF software hardening using ASD and vendor guidance with the same conflict-resolution principle. Both controls are aligned in scope (PDF software), intent (secure configuration), and prescriptiveness (follow ASD/vendor guidance with most restrictive precedence).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.