ASD ISM 1962 Disable SMBv1 protocol on networks
What it says
SMB version 1 is not used on networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure SMB version 1 is not active on network systems to enhance security.
Disabling the SMB version 1 protocol on your network means turning off an old way computers used to share files with each other. This matters because keeping it on is like leaving the back door open; cyber attackers can use it to get into your systems and steal or damage your information.
Free. Save your status, tasks and notes.
Why it matters
Leaving SMBv1 enabled allows attackers to exploit known vulnerabilities for data theft, disruption or ransomware attacks.
How to implement
The IT team should disable SMB version 1 on all network systems.
To do this, they need to update each system's settings or use a central network management tool to turn off this feature network-wide.
Managers should ensure their teams are aware of this change in file-sharing methods.
They can do this by communicating the new processes for file sharing that replace the old methods relying on SMB version 1.
The system administrator should review current software and devices that might still use SMB version 1.
They should list these items and explore alternatives or updates that support newer, more secure versions of the protocol.
The IT team should conduct a network scan to detect any instance of SMB version 1 still in use.
This can be done using network security software that identifies outdated protocols and advises on necessary adjustments.
Managers and office staff should be trained on why SMB version 1 is being disabled and what new practices they should adopt instead.
This can be done through brief training sessions or circulating simple guides and checklists.
Keep it running
Regularly verify SMBv1 is disabled on all hosts; enforce via GPO/baselines and audit to prevent re-enablement.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration report: Request a report showing the protocol settings for the organisation's network systems. Look to check that SMB version 1 is not active on any system.
Good evidence
Is a report showing all systems with only supported versions of the SMB protocol enabled.
- Check 2 of 5What an auditor asks for
Ask for
A list of software and devices that used SMB version 1: Request documentation that lists any systems or devices previously using SMB version 1. Look to ensure all listed items have been updated or replaced.
Good evidence
Includes confirmation of updates or replacements, with no item relying on SMB version 1.
- Check 3 of 5What an auditor asks for
Ask for
Network scan results: Request the latest scan report detailing network settings and protocol use.
Look at
Evidence that scans checked for SMB version 1 usage and found none.
Good evidence
Is a clear report indicating all systems are compliant with updated SMB protocols.
- Check 4 of 5What an auditor asks for
Ask for
About communication plans: Request records of how the organisation communicated changes about SMB version 1 to staff.
Look at
Emails, announcements, or training sessions that explain the need for changes and instructions on what to do instead.
Good evidence
Includes detailed communication efforts ensuring all staff understand the changes.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request documents showing staff training on the new file-sharing methods. Look to see if all relevant staff attended the training and understood the changes.
Good evidence
Is complete attendance records and feedback demonstrating staff understanding of the new protocols.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1962 requires SMB version 1 to not be used on organisational networks by disabling the legacy SMBv1 protocol. Annex A 8.20 requires networks and network devices to be secured and controlled, which commonly includes disabling insecure legacy protocols such as SMBv1. Annex A 8.20 is broader and risk-based, while ISM-1962 is a specific prescriptive technical requirement focused on one protocol.
This control partially meets A.8.21.
ISM-1962 requires SMB version 1 to not be used on networks, reducing exposure to known weaknesses in legacy file-sharing services. Annex A 8.21 requires security mechanisms and requirements for network services to be identified, implemented and monitored, which would typically drive decisions to disable or deprecate insecure services/protocol versions like SMBv1. Annex A 8.21 covers all network services and governance/monitoring expectations, whereas ISM-1962 is limited to eliminating SMBv1 specifically.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.