ASD ISM 1896 Enable memory integrity for credential protection
What it says
Memory integrity functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure memory integrity is activated to safeguard credential data.
This control is about making sure your computer's memory is protected to keep your password and other important data safe. If you don't turn on this feature, hackers might be able to steal sensitive information and misuse it, which could lead to identity theft or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without memory integrity, credential theft becomes easier, increasing the risk of identity fraud and potential financial losses for the organisation.
How to implement
System owners should work with the IT team to enable memory integrity on all computers.
This involves accessing system settings and ensuring that the feature is turned on. The IT team can provide step-by-step guidance if needed.
Managers should prioritise discussing memory integrity during team meetings.
Encourage employees to check if this setting is enabled on their devices and provide assistance where needed.
The IT team should regularly update the operating system to support memory integrity.
This may involve scheduling updates and ensuring all devices run the latest software versions.
HR should inform new hires about the importance of memory integrity during onboarding.
Provide a simple guide on checking this setting and where to get help if they are uncertain.
Procurement should consider memory integrity compatibility when buying new hardware.
Ensure new devices have this capability and that it's activated as part of the setup process.
Keep it running
Validate Memory Integrity (Core isolation) remains enabled after OS/driver updates, and alert on any setting changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of devices with memory integrity enabled: Request evidence that shows this security feature is active on all relevant systems.
Look at
The settings or configuration files for each system.
Good evidence
Each entry confirms the feature is enabled with the date it was last checked.
- Check 2 of 5What an auditor asks for
Ask for
Recent operating system updates schedule: Request records of when updates have been installed across the organisation's devices.
Look at
The dates and version numbers.
Good evidence
A log showing regular updates with the necessary patches to support memory integrity.
- Check 3 of 5What an auditor asks for
Ask for
Staff training materials about memory integrity: Request the documentation used for training employees on this topic.
Look at
The comprehensiveness and clarity of the information provided.
Good evidence
Materials that clearly explain the importance of memory integrity and how employees should ensure it's activated.
- Check 4 of 5What an auditor asks for
Ask for
New equipment purchase records: Request documentation that includes specifications for new hardware requiring memory integrity.
Look at
The specifications for this capability.
Good evidence
Records showing that all new devices can enable this feature and that it's part of the purchasing criteria.
- Check 5 of 5What an auditor asks for
Ask for
Onboarding checklists: Request the documentation used during new employee orientation.
Look at
The inclusion of the memory integrity check.
Good evidence
Checklists that show new hires are informed about this feature and have steps to activate it during their setup.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.4, Memory integrity functionality is enabled, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
ISM-1896 requires enabling memory integrity functionality as a specific technical safeguard to protect credentials from memory-based attacks on endpoints. This is a concrete endpoint protection mechanism that fits within ISO/IEC 27001:2022 Annex A 8.1, which broadly requires protecting information on, processed by, or accessible via user endpoint devices. Annex A 8.1 covers a wider range of endpoint controls (e.g. configuration hardening, malware protection, encryption), while ISM-1896 is one specific hardening configuration aimed at credential protection.
ASD Essential Eight: 1 mapping
This control is equivalent to E8-RA-ML3.4.
E8-RA-ML3.4 requires memory integrity functionality to mitigate memory-based attacks and unauthorised code execution. ISM-1896 also requires that memory integrity functionality is enabled. The requirement, scope, and technical intent are substantially the same, meaning implementing one largely satisfies the other.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.