ASD ISM 1914 Ensure operating systems have approved configurations
What it says
Approved configurations for operating systems are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and maintain approved configurations for all operating systems.
This control is all about making sure your computers and servers follow a set of approved rules about how they should be set up. This is important because a computer that isn't set up right can act like an unlocked door, letting in viruses or hackers who can steal data and cause chaos in your business.
Free. Save your status, tasks and notes.
Why it matters
Without approved OS configurations, insecure defaults and configuration drift increase vulnerability exposure, enabling compromise, data breaches and outages.
How to implement
System owners should work with the IT team to create a list of approved settings for each type of computer in use.
This involves deciding on the best security settings that protect the system without interrupting daily work, and documenting these settings clearly.
The IT team should apply these approved settings to all existing computers and servers.
This can be done by setting up each device according to the list of configurations, using tools or scripts where possible to automate the process.
Managers should ensure that new computers are set up according to the approved configurations before they are used by staff.
They can do this by running a checklist provided by the IT team that confirms each device matches the approved settings.
The IT team should regularly check that all devices still match the approved configurations.
They can schedule timing for reviews and use tools that automatically compare each device's settings against the approved list.
System owners and managers should review and update the approved configurations periodically or after any major software updates.
This ensures that the settings are still effective against new threats and compatible with any updates or changes in software.
Keep it running
Define approved OS hardening baselines, deploy via configuration management, and regularly scan for drift; remediate deviations or document exceptions via change control.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The approved configuration document: Request the document detailing the specific settings for each type of device.
Look at
The date of the last update and signs of official approval, like a manager's signature.
Good evidence
Means the document is current, comprehensive, and clearly approved.
- Check 2 of 5What an auditor asks for
Ask for
A recent report showing how the current device setups match the approved configurations.
Look at
Gaps where devices don't match the settings.
Good evidence
Will show most, if not all, devices in full compliance.
- Check 3 of 5What an auditor asks for
Look at
How well these align with the approved configurations.
Good evidence
Includes clear steps that ensure conformity from the start.
- Check 4 of 5What an auditor asks for
Ask for
Records of periodic checks: Request evidence of routine audits of existing device settings.
Look at
Logs or reports that show checks were actually done.
Good evidence
Shows regular checks with findings documented and acted upon.
- Check 5 of 5What an auditor asks for
Ask for
Records of any changes to the approved configurations.
Look at
Updated documents and explanations of why changes were made.
Good evidence
Includes a rationale for updates with dates and responsible person details.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.8.
Annex A 8.8 requires obtaining vulnerability information, evaluating exposure and implementing measures including secure configuration of platforms. ISM-1914 requires approved configurations for operating systems to be developed, implemented and maintained, directly reducing exposure from insecure OS settings and configuration drift. Annex A 8.8 is broader because it encompasses vulnerability identification and assessment activities and is not limited to OS configuration baselining.
This control partially meets A.8.9.
Annex A 8.9 requires secure configurations to be established and managed across IT systems. ISM-1914 aligns by requiring approved configurations for operating systems to be developed, implemented and maintained. ISM-1914 is limited to operating systems, while Annex A 8.9 spans OS, applications, hardware, services and networks and explicitly includes monitoring and review.
ASD Essential Eight: 1 mapping
This control is broader than E8-AH-ML3.2.
E8-AH-ML3.2 requires organisations to disable or remove Windows PowerShell 2.0 on Windows systems. ISM-1914 requires approved configurations for operating systems to be developed, implemented and maintained, and an approved Windows baseline would typically mandate disabling legacy components like PowerShell 2.0. ISM-1914 covers the full lifecycle of OS configuration governance, whereas E8-AH-ML3.2 is one specific configuration outcome.
ASD Essentials for enterprise IT: 3 mappings
- IT.PRO-01.2Use secure build and deployment processes to enforce security controls consistentlyPartially overlaps
This control partially overlaps IT.PRO-01.2.
IT.PRO-01.2 requires secure build and deployment processes that enforce controls consistently across systems; ISM-1914 supports this for operating systems, requiring approved configurations to be developed, implemented and maintained.
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; ISM-1914 requires approved operating system configurations to be developed, implemented and maintained, which goes beyond defining them.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1914 requires approved operating system configurations to be developed, implemented and maintained, covering the operating system part of it.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.