Application control restricts the execution of drivers to an organisation-approved set

frameworkASD Essential Eight sectionApplication control levelsML3 csf 2.0PR.PS-05 topics— frameworks0 0 3

Official textApplication control restricts the execution of drivers to an organisation-approved set.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1658 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-05	Installation and execution of unauthorized software are prevented	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
ISO 27001	A.8.1 A.8.7 A.8.19	User endpoint devices; Protection against malware…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
CIS v8.1	CIS 2.5 CIS 2.6 CIS 2.7 CIS 10.2	Allowlist Authorized Software; Allowlist Authorized Libraries…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping +5 more loosely related (not mappings) CIS 10.3 Disable Autorun and Autoplay for Removable Media Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.4 Configure Automatic Anti-Malware Scanning of Removable Media Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.5 Enable Anti-Exploitation Features Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.6 Centrally Manage Anti-Malware Software Loosely related Only shares CSF PR.PS-05: related, not a mapping …and 1 more in the downloads
SOC 2	CC6.8	Preventing or detecting unauthorized or malicious software	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
PCI DSS	2.2.1 5.3.2 6.4.3	System configuration standards developed and maintained; Periodic scans or continuous behavioural analysis…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
CMMC	SI.L2-3.14.2 SI.L2-3.14.4	Malicious Code Protection; Update Malicious Code Protection	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
800-53	CM-7 CM-7(5)SC-34 SI-3	Least Functionality; Authorized Software — Allow-by-exception…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
HIPAA	§164.308(a)(5)(ii)(B)	Protection from Malicious Software	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.7 6.9	Network security; Protection against malicious and unauthorised software	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 5	Malware protection	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.