Application control
Allow only approved executables, scripts, installers, libraries and drivers to run, and log what is allowed and blocked. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 3 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0843 | Application control is implemented on workstations. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1657 | Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1870 | Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
Maturity Level Two · 8 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0843 | Application control is implemented on workstations. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1490 | Application control is implemented on internet-facing servers. | ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1544 | Microsoft’s recommended application blocklist is implemented. | ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1582 | Application control rulesets are validated at least annually. | ML2, ML3 | — |
| ISM-1657 | Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1660 | Allowed and blocked application control events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1870 | Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1871 | Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients. | ML2, ML3 | — |
Maturity Level Three · 11 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0843 | Application control is implemented on workstations. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1490 | Application control is implemented on internet-facing servers. | ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1544 | Microsoft’s recommended application blocklist is implemented. | ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1582 | Application control rulesets are validated at least annually. | ML2, ML3 | — |
| ISM-1656 | Application control is implemented on non-internet-facing servers. | ML3 | — |
| ISM-1657 | Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1658 | Application control restricts the execution of drivers to an organisation-approved set. | ML3 | — |
| ISM-1659 | Microsoft’s vulnerable driver blocklist is implemented. | ML3 | — |
| ISM-1660 | Allowed and blocked application control events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1870 | Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients. | ML1, ML2, ML3 | A.8.1 CC6.8 DE.CM-09 |
| ISM-1871 | Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients. | ML2, ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight