ASD ISM 1916 Ensure server application configurations are approved
What it says
Approved configurations for server applications are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations should create and maintain approved settings for server software to ensure security.
This control means that organisations should develop and stick to a set of approved settings for their server software to keep things secure. If this isn't done, servers may become vulnerable to attacks, which could result in data breaches, loss of customer trust, or financial harm.
Free. Save your status, tasks and notes.
Why it matters
Without approved server application configurations, insecure settings can be introduced, enabling exploitation and causing data breaches and loss of trust.
How to implement
System owners should identify and document the necessary software configurations that must be approved before being applied to servers.
They can do this by consulting with IT specialists to determine security needs and creating a standard checklist of configurations.
The IT team should apply only those configurations that have been formally approved.
This means following a documented process where all changes must be reviewed and signed off by a responsible party before implementation.
Managers should conduct regular training sessions to ensure that staff understand why approved configurations are crucial.
They can use real-world examples of security incidents due to improper configurations to highlight the importance.
IT teams should schedule regular reviews of the configuration settings to ensure they remain up-to-date and secure.
This involves checking current configurations against the approved list and making updates as necessary.
System owners should create a simple process for updating the approved configurations.
This process should include gathering input from key stakeholders and documenting any changes made to help maintain clarity and consistency.
Keep it running
Review and update approved server application configuration baselines regularly; enforce change control to prevent unauthorised configuration changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The approved configuration standards document: Request the file that outlines all approved server settings.
Look at
Clear details of each configuration and approval dates.
Good evidence
Standards are detailed, dated, and approved by a responsible authority.
- Check 2 of 5What an auditor asks for
Ask for
To see the change approval record: Request evidence of approved changes for server configurations.
Look at
Whether each change has documented approval.
Good evidence
All changes have approval records and are consistent with the standard.
- Check 3 of 5What an auditor asks for
Ask for
Training session records: Request logs or records of training sessions focused on server configurations.
Look at
Attendee lists, topics covered, and dates.
Good evidence
Regular sessions are conducted with comprehensive coverage of relevant topics.
- Check 4 of 5What an auditor asks for
Ask for
The procedure document for reviewing configurations: Request the document detailing how configuration reviews are conducted.
Look at
Steps that specify how often reviews occur and who is responsible.
Good evidence
Procedure is clear, scheduled, and responsibilities are well-defined.
- Check 5 of 5What an auditor asks for
Ask for
Recent review reports: Request recent reports or records from configuration reviews.
Look at
Findings, suggested changes, and any actions taken.
Good evidence
Reports are thorough, with documented follow-up actions for improvements.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.8.8.
Annex A 8.8 requires managing security configuration as part of reducing exposure to technical vulnerabilities. ISM-1916 requires approved configurations for server applications to be developed, implemented and maintained, which is a specific secure-configuration control to prevent insecure defaults and drift. Annex A 8.8 is broader because it also covers vulnerability intelligence and exposure evaluation across systems, not only server application configuration baselines.
This control partially meets A.8.9.
Annex A 8.9 requires secure configurations to be established, documented, implemented, monitored and reviewed across IT assets. ISM-1916 maps to this by requiring approved configurations for server applications to be developed, implemented and maintained. ISM-1916 is a specific subset focused only on server applications, whereas Annex A 8.9 covers all hardware, software, services and networks plus ongoing monitoring/review.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; ISM-1916 requires approved server application configurations to be developed, implemented and maintained, which goes beyond defining them.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.