ASD ISM 1916Ensure Server Application Configurations Are Approved
Official control statement
Approved configurations for server applications are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Organisations should create and maintain approved settings for server software to ensure security.
What this means in practice
This control means that organisations should develop and stick to a set of approved settings for their server software to keep things secure. If this isn't done, servers may become vulnerable to attacks, which could result in data breaches, loss of customer trust, or financial harm.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2024
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Server application hardeningTopic
Hardening server application configurations
Why it matters
Without approved server application configurations, insecure settings can be introduced, enabling exploitation and causing data breaches and loss of trust.
Operational notes
Review and update approved server application configuration baselines regularly; enforce change control to prevent unauthorised configuration changes.
Implementation tips
- System owners should identify and document the necessary software configurations that must be approved before being applied to servers. They can do this by consulting with IT specialists to determine security needs and creating a standard checklist of configurations.
- The IT team should apply only those configurations that have been formally approved. This means following a documented process where all changes must be reviewed and signed off by a responsible party before implementation.
- Managers should conduct regular training sessions to ensure that staff understand why approved configurations are crucial. They can use real-world examples of security incidents due to improper configurations to highlight the importance.
- IT teams should schedule regular reviews of the configuration settings to ensure they remain up-to-date and secure. This involves checking current configurations against the approved list and making updates as necessary.
- System owners should create a simple process for updating the approved configurations. This process should include gathering input from key stakeholders and documenting any changes made to help maintain clarity and consistency.
Audit / evidence tips
- AskThe approved configuration standards document: Request the file that outlines all approved server settingsLook atClear details of each configuration and approval datesGoodStandards are detailed, dated, and approved by a responsible authority
- AskTo see the change approval record: Request evidence of approved changes for server configurationsLook atWhether each change has documented approvalGoodAll changes have approval records and are consistent with the standard
- AskTraining session records: Request logs or records of training sessions focused on server configurationsLook atAttendee lists, topics covered, and datesGoodRegular sessions are conducted with comprehensive coverage of relevant topics
- AskThe procedure document for reviewing configurations: Request the document detailing how configuration reviews are conductedLook atSteps that specify how often reviews occur and who is responsibleGoodProcedure is clear, scheduled, and responsibilities are well-defined
- AskRecent review reports: Request recent reports or records from configuration reviewsLook atFindings, suggested changes, and any actions takenGoodReports are thorough, with documented follow-up actions for improvements
Cross-framework mappings
How ISM-1916 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(1)expand_less | ||
| Annex A 8.8 | Annex A 8.8 requires managing security configuration as part of reducing exposure to technical vulnerabilities | |
layersPartially meets(1)expand_less | ||
| Annex A 8.9 | Annex A 8.9 requires secure configurations to be established, documented, implemented, monitored and reviewed across IT assets | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.