Australian Information Security Manual ISM-1211: Administration under change and configuration management

What else in your programme already covers this

This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Guidelines for system management

• ISM-0042 System administration processes and procedures
• ISM-0298 Centralised and managed patching
• ISM-0300 Patching high assurance IT equipment
• ISM-0304 Removing unsupported applications
• ISM-1143 Patch management processes and procedures
• ISM-1380 Separate privileged operating environments
• ISM-1385 Segregation of administrative infrastructure
• ISM-1386 Management traffic sourced from administrative infrastructure