ASD ISM 2023 Maintain a reliable source for software
What it says
An authoritative source for software is established and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure a trustworthy source for software is available and maintained consistently.
This control is about making sure your organisation gets software from a reliable and trusted place. It's important because using dodgy software sources can lead to installing harmful programs, resulting in data breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Using untrusted software sources could introduce malware, risking data breaches, operational disruptions, and financial loss.
How to implement
The IT team should identify and document trusted sources for all software used in the organisation.
This means listing vendors and websites where software is approved to be downloaded from, and making sure this list is easily accessible.
Procurement teams need to include checking the authorised software source list in their purchasing process.
Before buying new software, they should verify it comes from one of the approved sources to prevent introducing unsafe software.
Managers should regularly review and update the list of trusted software sources.
They can set up quarterly check-ins with the IT team to make sure the list reflects any changes in software vendors or business needs.
The IT team must educate staff on the importance of only using software from trusted sources.
This can be done by running short training sessions explaining the risks of using unauthorised software and how to access the approved list.
System owners should set up alerts or controls that notify them if software is attempted to be installed from an unapproved source.
This can ensure quick action is taken to prevent a potential security incident.
Keep it running
Maintain an approved software repository/vendor list; require signature/hash verification and restrict installs to these sources.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of approved software sources: Request to see the document or system that lists where software can be safely obtained. Look to ensure it's comprehensive and up-to-date.
Good evidence
Is a detailed list with the date of the last review and who performed it.
- Check 2 of 5What an auditor asks for
Ask for
Procurement process records: Request documentation showing how software purchases are vetted against the approved sources list.
Look at
Evidence of checks being done prior to purchase.
Good evidence
Includes records of checks and approvals for recent software acquisitions.
- Check 3 of 5What an auditor asks for
Ask for
Staff training materials: Request to see the content used to educate staff about using authorised software sources.
Look at
Details on the risks of unauthorised sources.
Good evidence
Is easy-to-understand training resources used in the last 12 months.
- Check 4 of 5What an auditor asks for
Ask for
Change logs or alerts from IT systems: Request alert logs that show attempted installations from unapproved sources.
Look at
Instances of blocked installations or documented responses.
Good evidence
Shows timely interventions and follow-ups.
- Check 5 of 5What an auditor asks for
Ask for
Management review records: Request minutes from meetings where software source lists were reviewed.
Look at
Discussions about additions or removals of software sources due to security concerns.
Good evidence
Shows regular reviews with actionable outcomes.
Mappings
Closest match in ISO/IEC 27001: A.8.19, Secure software installation procedures, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.19.
Annex A 8.19 requires organisations to implement controlled, secure procedures for installing software on operational systems. ISM-2023 overlaps by requiring an authoritative source for software, which is a core mechanism used to ensure only trusted, approved software is installed. ISM-2023 is narrower in that it focuses on software sourcing, while Annex A 8.19 also covers installation governance such as authorisation, verification, and controlled deployment steps.
This control supports A.5.21.
ISM-2023 requires an organisation to establish and maintain an authoritative, trusted source for obtaining software. Annex A 5.21 requires processes to manage ICT supply chain security risks for products and services, which supports defining who is an approved software supplier, how software is procured, and how integrity is assured. Annex A 5.21 is broader across the entire ICT supply chain, whereas ISM-2023 is specifically about maintaining a reliable software source.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.