Skip to content
Cyber security incidents
ASD ISMISM-1970

ASD ISM 1970 Segregated environment for malicious code analysis

What it says

Malicious code processing for cyber security incident response or research purposes is conducted in a dedicated analysis environment segregated from other systems.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Malicious code should be analysed in a separate, isolated environment to prevent system contamination.

When analysing suspicious software or files, it's crucial to do so in a separate, secure area so it doesn't spread to your main systems. This protects your business from potential damage and keeps your everyday operations safe.

Why it matters

Without an isolated analysis space, harmful software could spread, disrupting business operations and risking data loss.

How to implement

  1. IT team should set up a dedicated analysis environment.

    Create a separate computer or network that is not connected to your main systems to safely analyse potentially harmful software.

  2. System owner should ensure only authorised staff access the analysis environment.

    Limit who can enter this area to trained cyber security staff to prevent accidental spread of malware.

  3. IT team should regularly update the analysis environment's security tools.

    Keep antivirus and monitoring software up-to-date to catch new types of malicious code.

  4. Managers should provide staff training on malicious code handling.

    Educate your team on recognising suspicious files and why using the isolated environment is important.

  5. Security team should document each analysis session.

    Keep a log of what malicious files were tested and the results, which helps refine future security responses.

Keep it running

Ensure the analysis environment remains isolated and updated, and review access logs regularly to prevent any potential breaches.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    the environment setup documentation. Verify there's a description of the isolated setup and the security measures in place.

    Good evidence

    will show well-documented separation from main systems.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    shows regular monitoring and no unauthorised access.

  3. Check 3 of 5What an auditor asks for

    Ask for

    a report on antivirus updates in the analysis environment.

    Look at

    records showing timely updates and patches applied to the system.

    Good evidence

    includes consistent, up-to-date logs.

  4. Check 4 of 5What an auditor asks for

    Look at

    completion certificates or attendance records for training courses.

    Good evidence

    shows regular and recent training sessions.

  5. Check 5 of 5What an auditor asks for

    Ask for

    a sample of analysis logs. Review entries to ensure they detail files tested and outcomes, indicating structured and careful analysis.

    Good evidence

    is comprehensive and regularly updated logs.

Mappings

Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.22Network segregation for securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.