Application control is applied to all locations other than user profiles and temporary…

frameworkASD Essential Eight sectionApplication control levelsML2, ML3 csf 2.0PR.PS-05 topics— frameworks0 0 3

Official textApplication control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0

gap from Essential Eight → gap to Essential Eight →

Wrong or missing mapping? Report it

Equivalents of ISM-1871 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.PS-05	Installation and execution of unauthorized software are prevented	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
ISO 27001	A.8.1 A.8.7 A.8.19	User endpoint devices; Protection against malware…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
CIS v8.1	CIS 2.5 CIS 2.6 CIS 2.7 CIS 10.2	Allowlist Authorized Software; Allowlist Authorized Libraries…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping +5 more loosely related (not mappings) CIS 10.3 Disable Autorun and Autoplay for Removable Media Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.4 Configure Automatic Anti-Malware Scanning of Removable Media Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.5 Enable Anti-Exploitation Features Loosely related Only shares CSF PR.PS-05: related, not a mapping CIS 10.6 Centrally Manage Anti-Malware Software Loosely related Only shares CSF PR.PS-05: related, not a mapping …and 1 more in the downloads
SOC 2	CC6.8	Preventing or detecting unauthorized or malicious software	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
PCI DSS	2.2.1 5.3.2 6.4.3	System configuration standards developed and maintained; Periodic scans or continuous behavioural analysis…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
CMMC	SI.L2-3.14.2 SI.L2-3.14.4	Malicious Code Protection; Update Malicious Code Protection	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
800-53	CM-7 CM-7(5)SC-34 SI-3	Least Functionality; Authorized Software — Allow-by-exception…	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
HIPAA	§164.308(a)(5)(ii)(B)	Protection from Malicious Software	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.7 6.9	Network security; Protection against malicious and unauthorised software	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 5	Malware protection	Loosely related	No mapping. Only shares CSF PR.PS-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.