Skip to content
Technological controls
ISO 27001A.8.19

ISO 27001 Annex A 8.19 Secure software installation procedures

What it says

Procedures and measures shall be implemented to securely manage software installation on operational systems.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure software installations are controlled to prevent security risks.

This control is about making sure that whenever software is installed on company computers, it's done in a way that keeps everything safe and secure. If this isn't done properly, it could lead to vulnerable systems that hackers could exploit, which might result in stolen data or disrupted operations.

Why it matters

Without controlled software installation, unauthorised apps can introduce security holes and malware, risking data breaches and operational failures.

How to implement

  1. The IT manager should ensure that only approved and trained staff can install or update software.

    This can be done by setting strict permissions on user accounts to limit who can install software, following policies and procedures aligned with ISO 27002:2022.

  2. The operations team should establish a process for authorising software updates, in which changes are reviewed and approved by management.

    Use a checklist or system to document the request, approval, and proof of testing, referencing Australian regulations like CPS 234.

  3. IT staff should conduct thorough testing of software updates before implementation.

    Set up a testing environment where new software can be trialed to identify potential issues, ensuring alignment with secure configurations as per ASD Essential Eight.

  4. The IT department should maintain an up-to-date inventory of all software versions used.

    Use a software management tool that tracks versions, update histories, and ensures compliance with the Privacy Act 1988 regarding data collection and use.

  5. Managers should ensure a fallback plan is ready in case of failed installations.

    Create a rollback strategy that includes backing up current software states so you can quickly restore systems if something goes wrong during updates.

Keep it running

Only install approved, signed software from trusted repositories; require change approval, least-privilege installers, and log installs with tested rollback/uninstall steps.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Request access to the list of personnel authorised to install software.

    Look at

    Check the list for clear authorisation levels and roles.

    Good evidence

    All listed individuals should have clear approval records and relevant training documentation.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the documentation process of software update authorisations.

    Look at

    Review the documentation for management approvals and relevant testing results.

    Good evidence

    The records should show a clear chain of command with every update authorised by management.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Request evidence of software testing procedures.

    Look at

    Examine logs of the testing environment results for each software before implementation.

    Good evidence

    Testing logs should demonstrate rigorous processes, noting any issues identified and resolved.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Request an inventory of current software versions.

    Look at

    Verify the inventory matches installed software across all systems.

    Good evidence

    The inventory should be complete, accurately reflecting what is in use, and include update histories.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for documentation of rollback plans for software installations.

    Look at

    Check for comprehensive backup and restoration procedures.

    Good evidence

    There should be explicit plans detailing how to revert installations, protecting data integrity during software failures.

Mappings

Closest match in ASD Essential Eight: E8-AC-ML3.2, Application control restricts driver execution to an approved set, which this control covers in full and more.

Essential Eight

ASD Essential Eight: 4 mappings

  • E8-AC-ML3.2Application control restricts driver execution to an approved setBroader than
  • E8-AC-ML3.3Microsoft's vulnerable driver blocklist is implementedBroader than
  • E8-AC-ML2.1Application control is implemented on internet-facing serversPartially overlaps
  • E8-AC-ML2.2Application control excludes user profiles and temporary foldersPartially overlaps
ASD ISM

ASD Information Security Manual: 24 mappings

  • ISM-0382Prevent unprivileged human users uninstalling or disabling approved applicationsBroader than
  • ISM-1245Remove temporary files after server installationBroader than
  • ISM-1608Scan third-party SOEs for malicious codeBroader than
  • ISM-1926Restrict identity servers to their designed role onlyBroader than
  • ISM-2111Remove temporary installation files post-installationBroader than
  • ISM-0042Maintain effective system administration practicesPartially meets
  • ISM-1635System owners implement security controls for each system and environmentPartially meets
  • ISM-1797Ensure software updates are securely signedPartially meets
ASD Essentials

ASD Essentials for enterprise IT: 3 mappings

  • IT.PRO-01.2Use secure build and deployment processes to enforce security controls consistentlyPartially overlaps
  • IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
  • IT.PRO-16.1Verify integrity, authenticity and provenance of software, components and updates before usePartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.

Get help with this control

ISO 27001 training

Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.