ASD ISM 1915 Ensure user application configurations are approved
What it says
Approved configurations for user applications are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure that all user applications follow approved setup guidelines to keep systems secure.
This control means making sure every application your team uses is set up in a secure way that's been officially approved. It's important because if apps are left unsecured, hackers might find ways to sneak into your systems, steal data, or damage your reputation.
Free. Save your status, tasks and notes.
Why it matters
Unapproved user application configurations can weaken security settings, enabling exploitation, data compromise and disruption to business operations.
How to implement
The IT team should create a list of applications used within the organisation.
They can start by surveying employees or checking software purchase records to ensure all applications are accounted for.
Once you have the application list, the IT team should review and establish secure setup guidelines for each one.
This can involve consulting with software vendors or following the Australian Cyber Security Centre (ACSC) recommendations on application hardening.
Managers should ensure that any software they plan to introduce is vetted by the IT team against these guidelines before it's used.
They can have a quick approval process in place where the IT team checks the setup against their checklist.
The IT team should periodically review applications to ensure they remain securely configured.
This can be done by scheduling quarterly checks and documenting the outcomes.
Appoint a system owner to take responsibility for each critical application.
They should maintain records of configurations and handle any changes or updates, ensuring compliance with approved setups.
Keep it running
Maintain approved application baselines; routinely compare deployed settings to the baseline, and require security approval and change records for any deviations.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of all applications currently in use.
Look at
Whether the list is comprehensive and up-to-date with all relevant software included.
Good evidence
List should match software purchase records and employee reports.
- Check 2 of 5What an auditor asks for
Look at
Whether these documents provide step-by-step instructions for secure setups. Good guidelines are clear, detailed, and reflect industry standards.
- Check 3 of 5What an auditor asks for
Ask for
Records of approvals for each application used.
Look at
Documented evidence that each application's configuration has been checked and approved by the IT team. Good records include approval dates and personnel involved.
- Check 4 of 5What an auditor asks for
Look at
Logs or reports from these review sessions showing actions taken to keep setups secure.
Good evidence
Has timely updates with corrective actions when necessary.
- Check 5 of 5What an auditor asks for
Ask for
Training records or meeting notes showing communication to users about these configurations.
Look at
Who attended these sessions and what information was shared.
Good evidence
Training record ensures all users know how to maintain application security.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control covers in full and more.
ISO/IEC 27001: 3 mappings
This control is broader than A.8.8.
Annex A 8.8 requires organisations to manage security configuration by identifying technical vulnerabilities, evaluating exposure and implementing appropriate measures. ISM-1915 specifically requires approved configurations for user applications to be developed, implemented and maintained, which is one concrete measure that reduces exposure arising from insecure application configuration. Annex A 8.8 is broader because it also covers vulnerability intelligence and exposure evaluation, not just maintaining approved user application configurations.
This control partially meets A.8.9.
ISM-1915 requires approved configurations for user applications to be developed, implemented, and maintained. Annex A 8.9 addresses configurations for hardware, software, services, and networks to be established, documented, implemented, monitored, and reviewed, which includes user applications. It implies a broader ICT configuration management with monitoring and review, beyond the user application focus of ISM-1915.
This control partially overlaps A.8.19.
ISM-1915 mandates the use of approved configurations for user applications and their maintenance. Annex A 8.19 covers secure software installation procedures, a key mechanism for ensuring secure and approved application installations. ISM-1915 covers post-installation configurations, while Annex A 8.19 is specific to installation controls.
ASD Essential Eight: 8 mappings
This control is broader than E8-AH-ML1.1.
E8-AH-ML1.1 requires Internet Explorer 11 to be disabled or removed as a specific approved hardening outcome. This supports ISM-1915 because removing IE11 is typically part of establishing and maintaining an approved standard configuration for user applications. ISM-1915 is broader, covering governance of approved configurations across all user applications, not just IE11.
This control is broader than E8-AH-ML2.6.
ISM-1915 demands approved user application configurations, which E8-AH-ML2.6 supports by specifying hardening for office tools using ASD and vendor guidance, forming part of a baseline.
This control is broader than E8-AH-ML2.9.
ISM-1915 necessitates approved configurations for user applications, allowing for a maintained baseline. E8-AH-ML2.9 mandates application hardening, specifically for PDF software, using ASD or vendor guidance which aids operationalisation of ISM-1915's broader requirements.
This control is broader than E8-RM-ML1.4.
ISM-1915 involves maintenance of approved user application configurations. E8-RM-ML1.4 ensures that Microsoft Office macro security settings remain unchanged by users, supporting ISM-1915 within the scope of macro settings.
This control is broader than E8-RM-ML2.1.
E8-RM-ML2.1 demands specific configuration to block macros' Win32 API calls. ISM-1915 covers the broader governance of application configurations, which includes but is not limited to the specific hardening required by E8-RM-ML2.1.
This control supports E8-AH-ML2.5.
E8-AH-ML2.5 requires a specific approved configuration in Microsoft Office to prevent activation of OLE packages. ISM-1915 requires organisations to develop, implement and maintain approved configurations for user applications, providing the governance and baseline management needed to mandate settings like disabling OLE activation. E8-AH-ML2.5 is a concrete configuration outcome, while ISM-1915 establishes the prerequisite configuration management approach for user applications.
This control supports E8-AH-ML2.7.
ISM-1915 requires maintenance of approved configurations across applications. E8-AH-ML2.7 assists by enforcing immutable security settings for office suites.
This control supports E8-AH-ML2.10.
ISM-1915 ensures that approved configurations for user applications are sustained. E8-AH-ML2.10 demands that PDF software security settings remain immutable by users, complementing ISM-1915 by preventing unauthorised changes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.