Essential Eight · strategy 7 of 8
User application hardening
Harden web browsers, Office and PDF software, disable legacy components, restrict PowerShell, and log what matters. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 4 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1485 | Web browsers do not process web advertisements from the internet. | ML1, ML2, ML3 | — |
| ISM-1486 | Web browsers do not process Java from the internet. | ML1, ML2, ML3 | — |
| ISM-1585 | Web browser security settings cannot be changed by human users. | ML1, ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1654 | Internet Explorer 11 is disabled or removed. | ML1, ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
Maturity Level Two · 16 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1412 | Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur. | ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1485 | Web browsers do not process web advertisements from the internet. | ML1, ML2, ML3 | — |
| ISM-1486 | Web browsers do not process Java from the internet. | ML1, ML2, ML3 | — |
| ISM-1542 | Microsoft Office is configured to prevent activation of Object Linking and Embedding packages. | ML2, ML3 | — |
| ISM-1585 | Web browser security settings cannot be changed by human users. | ML1, ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1623 | PowerShell module logging, script block logging and transcription events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1654 | Internet Explorer 11 is disabled or removed. | ML1, ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1667 | Microsoft Office is blocked from creating child processes. | ML2, ML3 | — |
| ISM-1668 | Microsoft Office is blocked from creating executable content. | ML2, ML3 | — |
| ISM-1669 | Microsoft Office is blocked from injecting code into other processes. | ML2, ML3 | — |
| ISM-1670 | PDF applications are blocked from creating child processes. | ML2, ML3 | — |
| ISM-1823 | Office productivity suite security settings cannot be changed by human users. | ML2, ML3 | — |
| ISM-1824 | PDF application security settings cannot be changed by human users. | ML2, ML3 | — |
| ISM-1859 | Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur. | ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1860 | PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur. | ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1889 | Command line process creation events are centrally logged. | ML2, ML3 | — |
Maturity Level Three · 20 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1412 | Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur. | ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1485 | Web browsers do not process web advertisements from the internet. | ML1, ML2, ML3 | — |
| ISM-1486 | Web browsers do not process Java from the internet. | ML1, ML2, ML3 | — |
| ISM-1542 | Microsoft Office is configured to prevent activation of Object Linking and Embedding packages. | ML2, ML3 | — |
| ISM-1585 | Web browser security settings cannot be changed by human users. | ML1, ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1621 | Windows PowerShell 2.0 is disabled or removed. | ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1622 | PowerShell is configured to use Constrained Language Mode. | ML3 | — |
| ISM-1623 | PowerShell module logging, script block logging and transcription events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1654 | Internet Explorer 11 is disabled or removed. | ML1, ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1655 | .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed. | ML3 | — |
| ISM-1667 | Microsoft Office is blocked from creating child processes. | ML2, ML3 | — |
| ISM-1668 | Microsoft Office is blocked from creating executable content. | ML2, ML3 | — |
| ISM-1669 | Microsoft Office is blocked from injecting code into other processes. | ML2, ML3 | — |
| ISM-1670 | PDF applications are blocked from creating child processes. | ML2, ML3 | — |
| ISM-1823 | Office productivity suite security settings cannot be changed by human users. | ML2, ML3 | — |
| ISM-1824 | PDF application security settings cannot be changed by human users. | ML2, ML3 | — |
| ISM-1859 | Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur. | ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1860 | PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur. | ML2, ML3 | A.8.9 CC5.2 PR.PS-01 |
| ISM-1889 | Command line process creation events are centrally logged. | ML2, ML3 | — |
| ISM-1896 | Memory integrity functionality is enabled. | ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight