ASD ISM 1913 Develop and maintain approved IT configurations
What it says
Approved configurations for IT equipment are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure IT equipment is set up with approved configurations to enhance security.
This control is about making sure all your computer and IT devices are set up in a way that's been officially approved to keep your business safe from cyber threats. If your hardware and software settings aren't configured correctly, it makes it easier for hackers and malware to cause trouble, potentially leading to data breaches or loss of sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If approved configuration baselines aren't maintained, systems drift into insecure states, creating gaps and inconsistent hardening that can be exploited for unauthorised access.
How to implement
IT team should document approved configurations: They need to write down specific settings for all IT equipment like computers, servers, and routers.
This might include settings such as password policies and firewall rules. Once documented, these should be reviewed by someone experienced and shared with all relevant staff.
System owners should ensure devices are configured correctly: The person responsible for each piece of IT equipment should make sure they follow the documented settings exactly.
They can use a simple checklist and verify each device, asking the IT team for help if needed.
Managers should provide training: Make sure everyone in the organisation who uses IT equipment knows why these configurations are important.
Run training sessions every few months where the IT team explains how the configurations protect the organisation.
IT team should implement regular checks: Set up a routine, like quarterly checks, where the IT team reviews a sample of equipment to ensure they still match the approved configurations.
Use an easy-to-follow list and keep track of any changes.
Management should endorse the configuration policies: Have a meeting where managers formally approve the documented configurations and commit to supporting adherence.
During this meeting, they should discuss the importance of configurations and agree on how they'll promote consistent use.
Keep it running
Define approved baseline builds, deploy via configuration management, and routinely verify against the baseline; investigate and remediate drift and only apply changes via approved change control.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The configuration documentation: Request to see the written records of the approved settings for IT equipment.
Look at
How detailed and specific the settings are.
Good evidence
Is a well-structured document that covers each type of device used, with settings clearly laid out.
- Check 2 of 5What an auditor asks for
Ask for
The training logs: Request records that show when and how staff were trained on IT configurations.
Look at
Dates and attendance lists.
Good evidence
Is a series of regular sessions with good attendance and covered topics matching the importance of the configurations.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of implementation: Request examples where the approved settings were applied to devices.
Look at
The settings screens on a random sample of computers.
Good evidence
Is devices matching the documented configurations closely.
- Check 4 of 5What an auditor asks for
Ask for
About review and update processes: Request information on how configuration settings are kept current.
Look at
A formal review schedule or evidence of updates in response to new threats.
Good evidence
Is a routine process for updating the configurations based on recent security advice from the ACSC (Australian Cyber Security Centre).
- Check 5 of 5What an auditor asks for
Ask for
Logging and monitoring records: Request logs that show any changes made to device configurations.
Look at
Anomalies or unauthorised changes.
Good evidence
Is consistent logs with authorised actions only, reviewed regularly to identify any unexpected changes.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is equivalent to A.8.9.
ISM-1913 requires approved configurations for IT equipment to be developed, implemented and maintained. Annex A 8.9 similarly requires configurations (including security configurations) for hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. Both controls cover the configuration lifecycle and the expectation of ongoing maintenance and governance of secure baselines.
This control partially overlaps A.8.8.
ISM-1913 requires approved configurations for IT equipment to be developed, implemented and maintained. Annex A 8.8 focuses on obtaining vulnerability information, evaluating exposure and taking appropriate measures, which often results in configuration hardening or changes to approved baselines. The overlap is in configuration updates driven by vulnerabilities, but Annex A 8.8 is broader vulnerability management, while ISM-1913 is baseline configuration governance.
ASD Essential Eight: 1 mapping
This control supports E8-AH-ML2.5.
E8-AH-ML2.5 requires implementing a defined Microsoft Office configuration that prevents OLE package activation. ISM-1913 requires approved configurations for IT equipment to be developed, implemented and maintained, which underpins an organisation's ability to standardise and enforce Office hardening settings. The primary control is a specific technical setting, while ISM-1913 is the broader prerequisite practice that enables consistent deployment and maintenance of that setting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.