Guidelines for system hardening
161 controls · September 2026 edition
- ISM-0341 · Hardening operating system configurations
Automatic execution features for removable media are disabled.
- ISM-0343 · Device access control
If there is no business requirement for writing to removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.
- ISM-0345 · Device access control
External communication interfaces that allow DMA are disabled.
- ISM-0380 · Hardening operating system configurations
Unneeded user accounts, components, services and functionality of operating systems are disabled or removed.
- ISM-0382 · Application management
Unprivileged human users do not have the ability to uninstall or disable approved applications.
- ISM-0383 · Hardening operating system configurations
Default user accounts or credentials for operating systems, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
- ISM-0582 · Operating system event logging
Security-relevant events for Microsoft Windows operating systems are centrally logged.
- ISM-0843 · Application control
Application control is implemented on workstations.
- ISM-0846 · Application control
Users cannot disable or bypass application control, and are not exempted from application control, except when using local administrator accounts or break glass accounts.
- ISM-0938 · User application selection
Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for user applications.
- ISM-0955 · Application control
Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules.
- ISM-1034 · Host-based intrusion detection and response solution
A HIPS or EDR solution is implemented on critical servers and high-value servers.
- ISM-1235 · Hardening user application configurations
Extensions for user applications are restricted to an organisation-approved set.
- ISM-1245 · Hardening server application configurations
All temporary installation files created during server application installation processes are removed after server applications have been installed.
- ISM-1246 · Hardening server application configurations
Server applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
- ISM-1247 · Hardening server application configurations
Unneeded user accounts, components, services and functionality of server applications are disabled or removed.
- ISM-1249 · Restricting privileges for server applications
Server applications are configured to run as a separate user account with the minimum privileges needed to perform their functions.
- ISM-1250 · Restricting privileges for server applications
The user accounts under which server applications run have limited access to their underlying server’s file system.
- ISM-1260 · Hardening server application configurations
Default user accounts or credentials for server applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
- ISM-1341 · Host-based intrusion detection and response solution
A HIPS or EDR solution is implemented on workstations.
- ISM-1392 · Application control
When implementing application control using path rules, only approved users can modify approved files and write to approved folders.
- ISM-1406 · Standard operating environments
SOEs are used for workstations and servers.
- ISM-1407 · Operating system releases and versions
The latest release, or the previous release, of operating systems are used.
- ISM-1408 · Operating system releases and versions
64-bit versions of operating systems are used.
- ISM-1409 · Hardening operating system configurations
Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
- ISM-1412 · Web browsers
Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
- ISM-1416 · Software firewall
A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services.
- ISM-1417 · Antivirus application
An antivirus application is implemented on workstations and servers with:
- ISM-1418 · Device access control
If there is no business requirement for reading from removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.
- ISM-1460 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism is from a vendor that has demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices.
- ISM-1461 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical computing resources for SECRET or TOP SECRET operating environments, the physical server and all operating environments are of the same classification and belong to the same security domain.
- ISM-1467 · User application releases
The latest release of email clients, office productivity suites, PDF applications, security products and web browsers, including their extensions, are used.
- ISM-1470 · Hardening user application configurations
Unneeded user accounts, components, services and functionality of user applications are disabled or removed.
- ISM-1471 · Application control
When implementing application control using publisher certificate rules, publisher names and product names are used.
- ISM-1483 · Server application releases
The latest release of internet-facing server applications is used.
- ISM-1485 · Web browsers
Web browsers do not process web advertisements from the internet.
- ISM-1486 · Web browsers
Web browsers do not process Java from the internet.
- ISM-1487 · Office productivity suites
Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.
- ISM-1488 · Office productivity suites
Microsoft Office macros in files originating from the internet are blocked.
- ISM-1489 · Office productivity suites
Microsoft Office macro security settings cannot be changed by human users.
- ISM-1490 · Application control
Application control is implemented on internet-facing servers.
- ISM-1491 · Hardening operating system configurations
Unprivileged human users are prevented from running script execution engines, including:
- ISM-1492 · Hardening operating system configurations
Operating system exploit protection functionality is enabled.
- ISM-1542 · Office productivity suites
Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.
- ISM-1544 · Application control
Microsoft’s recommended application blocklist is implemented.
- ISM-1582 · Application control
Application control rulesets are validated at least annually.
- ISM-1584 · Hardening operating system configurations
Unprivileged users are prevented from bypassing, disabling or modifying security functionality of operating systems.
- ISM-1585 · Web browsers
Web browser security settings cannot be changed by human users.
- ISM-1588 · Standard operating environments
SOEs are reviewed and updated at least annually.
- ISM-1592 · Application management
Unprivileged human users do not have the ability to install unapproved applications.
- ISM-1601 · Hardening operating system configurations
Microsoft’s attack surface reduction rules are implemented.
- ISM-1604 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical computing resources, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism.
- ISM-1605 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical computing resources, the underlying operating system is hardened.
- ISM-1606 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical computing resources, patches, updates or vendor mitigations for vulnerabilities are applied to the isolation mechanism and underlying operating system in a timely manner.
- ISM-1607 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical resources, integrity monitoring and centralised event logging is performed for the isolation mechanism and underlying operating system.
- ISM-1608 · Standard operating environments
SOEs provided by third parties are scanned for malicious code and configurations.
- ISM-1620 · Microsoft Active Directory Domain Services security group memberships
Privileged user accounts are members of the Protected Users security group.
- ISM-1621 · PowerShell
Windows PowerShell 2.0 is disabled or removed.
- ISM-1622 · PowerShell
PowerShell is configured to use Constrained Language Mode.
- ISM-1623 · PowerShell
PowerShell module logging, script block logging and transcription events are centrally logged.
- ISM-1624 · PowerShell
PowerShell script block logs are protected by Protected Event Logging functionality.
- ISM-1654 · Hardening operating system configurations
Internet Explorer 11 is disabled or removed.
- ISM-1655 · Hardening operating system configurations
.NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
- ISM-1656 · Application control
Application control is implemented on non-internet-facing servers.
- ISM-1657 · Application control
Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.
- ISM-1658 · Application control
Application control restricts the execution of drivers to an organisation-approved set.
- ISM-1659 · Application control
Microsoft’s vulnerable driver blocklist is implemented.
- ISM-1660 · Application control
Allowed and blocked application control events are centrally logged.
- ISM-1667 · Office productivity suites
Microsoft Office is blocked from creating child processes.
- ISM-1668 · Office productivity suites
Microsoft Office is blocked from creating executable content.
- ISM-1669 · Office productivity suites
Microsoft Office is blocked from injecting code into other processes.
- ISM-1670 · Portable Document Format applications
PDF applications are blocked from creating child processes.
- ISM-1671 · Office productivity suites
Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement.
- ISM-1672 · Office productivity suites
Microsoft Office macro antivirus scanning is enabled.
- ISM-1673 · Office productivity suites
Microsoft Office macros are blocked from making Win32 API calls.
- ISM-1674 · Office productivity suites
Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.
- ISM-1675 · Office productivity suites
Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.
- ISM-1676 · Office productivity suites
Microsoft Office’s list of trusted publishers is validated at least annually.
- ISM-1743 · Operating system selection
Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for operating systems.
- ISM-1745 · Hardening operating system configurations
Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled.
- ISM-1746 · Application control
When implementing application control using path rules, only approved users can change file system permissions for approved files and folders.
- ISM-1748 · Email clients
Email client security settings cannot be changed by human users.
- ISM-1806 · Hardening user application configurations
Default user accounts or credentials for user applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.
- ISM-1823 · Office productivity suites
Office productivity suite security settings cannot be changed by human users.
- ISM-1824 · Portable Document Format applications
PDF application security settings cannot be changed by human users.
- ISM-1825 · Security products
Security product security settings cannot be changed by human users.
- ISM-1826 · Server application selection
Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for server applications.
- ISM-1827 · Microsoft Active Directory Domain Services
Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems.
- ISM-1828 · Microsoft Active Directory Domain Services
The Print Spooler service is disabled on Microsoft AD DS domain controllers.
- ISM-1829 · Microsoft Active Directory Domain Services
Passwords are not stored in Group Policy Preferences.
- ISM-1830 · Microsoft Active Directory services
Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are centrally logged.
- ISM-1832 · Microsoft Active Directory Domain Services account hardening
Only service accounts and computer accounts are configured with Service Principal Names (SPNs).
- ISM-1833 · Microsoft Active Directory Domain Services account hardening
User accounts are provisioned with the minimum privileges required.
- ISM-1834 · Microsoft Active Directory Domain Services account hardening
Duplicate SPNs do not exist within the domain.
- ISM-1835 · Microsoft Active Directory Domain Services account hardening
Privileged user accounts are configured as sensitive and cannot be delegated.
- ISM-1836 · Microsoft Active Directory Domain Services account hardening
User accounts require Kerberos pre-authentication.
- ISM-1838 · Microsoft Active Directory Domain Services account hardening
The UserPassword attribute for user accounts is not used.
- ISM-1839 · Microsoft Active Directory Domain Services account hardening
Account properties accessible by unprivileged users are not used to store passwords.
- ISM-1840 · Microsoft Active Directory Domain Services account hardening
User account passwords do not use reversible encryption.
- ISM-1841 · Microsoft Active Directory Domain Services account hardening
Unprivileged user accounts cannot add machines to the domain.
- ISM-1842 · Microsoft Active Directory Domain Services account hardening
Dedicated privileged service accounts are used to add machines to the domain.
- ISM-1843 · Microsoft Active Directory Domain Services account hardening
User accounts with unconstrained delegation are reviewed at least annually, and those without an SPN or demonstrated business requirement are removed.
- ISM-1844 · Microsoft Active Directory Domain Services account hardening
Computer accounts that are not Microsoft AD DS domain controllers are not trusted for delegation to services.
- ISM-1845 · Microsoft Active Directory Domain Services security group memberships
When a user account is disabled, it is removed from all security group memberships.
- ISM-1846 · Microsoft Active Directory Domain Services security group memberships
The Pre-Windows 2000 Compatible Access security group does not contain user accounts.
- ISM-1848 · Functional separation between operating environments
When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism or underlying operating system is replaced when it is no longer supported by a vendor.
- ISM-1859 · Office productivity suites
Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
- ISM-1860 · Portable Document Format applications
PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
- ISM-1870 · Application control
Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.
- ISM-1871 · Application control
Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.
- ISM-1889 · Command Shell
Command line process creation events are centrally logged.
- ISM-1890 · Office productivity suites
Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.
- ISM-1891 · Office productivity suites
Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.
- ISM-1896 · Hardening operating system configurations
Memory integrity functionality is enabled.
- ISM-1914 · Hardening operating system configurations
Approved configurations for operating systems are developed, implemented and maintained.
- ISM-1915 · Hardening user application configurations
Approved configurations for user applications are developed, implemented and maintained.
- ISM-1916 · Hardening server application configurations
Approved configurations for server applications are developed, implemented and maintained.
- ISM-1926 · Microsoft Active Directory services
Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are only used for their designed role and no other applications or services are installed, unless they are security related.
- ISM-1927 · Microsoft Active Directory services
Access to Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers is limited to privileged users that require access.
- ISM-1928 · Microsoft Active Directory services
Backups of Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are encrypted using ASD-approved cryptography, stored securely and only accessible to backup administrator accounts.
- ISM-1929 · Microsoft Active Directory Domain Services
Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain controllers.
- ISM-1930 · Microsoft Active Directory Domain Services
Passwords are prevented from being stored in Group Policy Preferences.
- ISM-1931 · Microsoft Active Directory Domain Services
SID Filtering is enabled for domain and forest trusts.
- ISM-1932 · Microsoft Active Directory Domain Services account hardening
The number of service accounts configured with an SPN is minimised.
- ISM-1933 · Microsoft Active Directory Domain Services account hardening
Service accounts configured with an SPN do not have DCSync permissions.
- ISM-1934 · Microsoft Active Directory Domain Services account hardening
User accounts with DCSync permissions are reviewed at least every six months, and those without an ongoing requirement for the permissions have them removed.
- ISM-1935 · Microsoft Active Directory Domain Services account hardening
Computer accounts are not configured for unconstrained delegation.
- ISM-1936 · Microsoft Active Directory Domain Services account hardening
The sIDHistory attribute for user accounts is not used.
- ISM-1937 · Microsoft Active Directory Domain Services account hardening
User accounts are checked at least weekly for the presence of the sIDHistory attribute.
- ISM-1938 · Microsoft Active Directory Domain Services account hardening
The Domain Computers security group does not have write or modify permissions to any Microsoft Active Directory objects.
- ISM-1939 · Microsoft Active Directory Domain Services security group memberships
The number of user accounts that are members of the Domain Admins, Enterprise Admins or other highly privileged security groups is minimised.
- ISM-1940 · Microsoft Active Directory Domain Services security group memberships
Service accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.
- ISM-1941 · Microsoft Active Directory Domain Services security group memberships
Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.
- ISM-1942 · Microsoft Active Directory Domain Services security group memberships
The Domain Computers security group is not a member of any privileged or highly privileged security groups.
- ISM-1943 · Microsoft Active Directory Certificate Services
Strong mapping between certificates and users is enforced.
- ISM-1944 · Microsoft Active Directory Certificate Services
The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is removed from Microsoft AD CS certification authority configurations.
- ISM-1945 · Microsoft Active Directory Certificate Services
The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates.
- ISM-1946 · Microsoft Active Directory Certificate Services
Unprivileged user accounts do not have write access to certificate templates.
- ISM-1947 · Microsoft Active Directory Certificate Services
Extended Key Usages that enable user authentication are removed.
- ISM-1948 · Microsoft Active Directory Certificate Services
Certificate manager approval is required for certificate templates that allow a Subject Alternative Name to be supplied.
- ISM-1949 · Microsoft Active Directory Federation Services
Microsoft AD FS servers are administered using a dedicated service account that is not used to administer other systems.
- ISM-1950 · Microsoft Entra Connect
Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial synchronisation activities.
- ISM-1951 · Microsoft Entra Connect
Hard match takeover is disabled for Microsoft Entra Connect servers.
- ISM-1952 · Microsoft Entra Connect
Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID.
- ISM-1976 · Operating system event logging
Security-relevant events for Apple macOS operating systems are centrally logged.
- ISM-1977 · Operating system event logging
Security-relevant events for Linux operating systems are centrally logged.
- ISM-1978 · Server application event logging
Security-relevant events for server applications on internet-facing servers are centrally logged.
- ISM-1979 · Server application event logging
Security-relevant events for server applications on non-internet-facing servers are centrally logged.
- ISM-2010 · Microsoft Active Directory Domain Services account hardening
Service accounts configured with an SPN use the Advanced Encryption Standard for encryption.
- ISM-2110 · Hardening user application configurations
User applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
- ISM-2111 · Hardening user application configurations
All temporary installation files created during user application installation processes are removed after user applications have been installed.
- ISM-2112 · Artificial intelligence applications
AI applications that process classified data have their ability to directly access external public data sources disabled.
- ISM-2113 · Artificial intelligence applications
AI applications are configured to require human approval before executing sensitive or high-impact actions.
- ISM-2114 · Artificial intelligence applications
Baselines of expected behaviour and performance for AI applications are established and monitored for unexpected deviations.
- ISM-2115 · Hardening server application configurations
Extensions for server applications are restricted to an organisation-approved set.
- ISM-2127 · Hardening operating system configurations
Digital signature verification functionality for drivers is enforced before they are loaded.
- ISM-2128 · Hardening operating system configurations
The ability to install, load or modify kernel-mode code, including drivers, kernel modules and extensions, is limited to privileged users who require such abilities as part of their duties or functions.
- ISM-2129 · Windows Management Instrumentation
WMI activity, including the creation of permanent event subscriptions, is centrally logged.
- ISM-2130 · Microsoft Active Directory Certificate Services
Web-based enrolment interfaces for Microsoft AD CS servers are disabled unless required, and where enabled, are configured to require HTTPS and Extended Protection for Authentication.
- ISM-2131 · Microsoft Active Directory Certificate Services
Certificate templates are reviewed at least every three months to identify and remediate misconfigurations that could enable privilege escalation or unauthorised certificate enrolment.
- ISM-2132 · Microsoft Active Directory Certificate Services
Certificate enrolment events, including successful and unsuccessful requests and changes to certificate templates or Microsoft AD CS configurations, are centrally logged.
Official control wording and applicability: Australian Signals Directorate, © Commonwealth of Australia 2026. September 2026 ISM, OSCAL v2026.09.4, reproduced under CC BY 4.0. Formatting is adapted for this website.
Latticework Systems’ implementation guidance is our interpretation. Provenance and scope.