Essential Eight AC-ML1.1 Application control is implemented on workstations.
What it says
Application control is implemented on workstations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure only approved software can run on office computers.
This control is about making sure that only approved software can run on the computers people use for work. Without this, you risk having harmful programs, like viruses or ransomware, sneak in and cause trouble by stealing data or locking you out of your systems.
Free. Save your status, tasks and notes.
Why it matters
Without application control, unauthorised software can execute, leading to data breaches or ransomware attacks that disrupt operations.
How to implement
IT team should create a list of approved software.
They can do this by reviewing all current software used in the organisation and deciding what is necessary and safe.
System administrators should configure application control software.
This involves setting up tools like AppLocker to only allow the approved software list to run on workstations.
Security officers should regularly review and update the approved software list.
They should consider adding new software when it becomes necessary and removing any that are outdated or risky.
IT team should conduct regular checks to ensure application control is working.
They can do this by trying to run unapproved software and confirming it is blocked by the system.
Keep it running
Review and update workstation allow lists regularly, approving required apps and blocking unauthorised executables, installers and scripts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What process is in place to approve software for use within the organisation?
Look at
Examine the list of approved software and the application control configuration.
Good evidence
There is a clear, documented process for approving software, and the application control settings match the approved list.
- Check 2 of 2What an auditor asks for
Ask for
How frequently is the list of approved software reviewed and updated?
Look at
Review records of the last few reviews and updates to the software list.
Good evidence
Regular review records show the list is updated at least quarterly or after any major software changes.
Mappings
Closest match in ASD Information Security Manual: ISM-0843, Ensure workstation security with application control, which asks for the same thing.
ASD Information Security Manual: 12 mappings
This control is equivalent to ISM-0843.
E8-AC-ML1.1 requires organisations to implement application control on workstations so only approved software can run. ISM-0843 states the same requirement-application control is implemented on workstations. Both controls align in scope (workstations) and intent (restrict execution to authorised applications) with no material difference in depth stated.
This control is broader than ISM-1658.
E8-AC-ML1.1 requires application control on workstations to ensure only approved software runs. ISM-1658 is broader in that it specifies application control must also restrict driver execution to an organisation-approved set, which is one specific class of executable content. E8-AC-ML1.1 would typically contribute to this outcome, but does not explicitly call out drivers.
This control partially meets ISM-1657.
E8-AC-ML1.1 requires implementing application control on workstations to restrict what software can execute. ISM-1657 relates directly by detailing the execution objects that application control must restrict (executables, libraries, scripts, installers, HTA/CHM, control panel applets) to an organisation-approved set. ISM-1657 is more prescriptive about coverage, while E8-AC-ML1.1 states the requirement at a higher level without listing the specific artefact types.
This control partially overlaps ISM-0955.
E8-AC-ML1.1 requires application control to be implemented on workstations to prevent unauthorised software execution. ISM-0955 supports E8-AC-ML1.1 by specifying acceptable technical mechanisms for implementing application control (hash, publisher certificate, or path rules). ISM-0955 is an implementation detail rather than the overarching requirement to have application control in place.
This control partially overlaps ISM-1235.
E8-AC-ML1.1 requires application control on workstations to ensure only approved software can run. ISM-1235 overlaps by applying the same allow-listing concept to add-ons, extensions and plug-ins within common workstation applications (browsers, office suites, email clients and PDF applications). ISM-1235 is more specific to in-application extensibility controls, whereas E8-AC-ML1.1 is typically focused on controlling application/script execution at the endpoint level.
This control partially overlaps ISM-1490.
ISM-1490 requires application control to be implemented on internet-facing servers to reduce the attack surface on externally exposed services. E8-AC-ML1.1 applies application control to workstations, which uses the same security technique but for a different asset class. The controls overlap on restricting application execution, but the primary is server-and-exposure focused whereas the candidate is endpoint focused.
This control partially overlaps ISM-1491.
ISM-1491 requires organisations to technically prevent unprivileged users from launching specific script execution engines (e.g. PowerShell, cmd.exe, wmic.exe, mshta.exe and Windows Script Host). E8-AC-ML1.1 requires application control on workstations, which can be implemented to block those same executables for standard users. E8-AC-ML1.1 is broader (covers general application allowlisting/denylisting) while ISM-1491 is a specific prohibition focused on script execution engines and unprivileged users.
This control partially overlaps ISM-1656.
ISM-1656 requires application control on non-internet-facing servers to prevent unauthorised application execution in secure server contexts. E8-AC-ML1.1 applies the same security mechanism (application control) but targets workstations instead of servers. The controls overlap in intent and technique, but differ materially in asset scope (server vs endpoint), so implementing one does not assure compliance with the other.
This control supports ISM-0846.
E8-AC-ML1.1 requires application control to be implemented on workstations. ISM-0846 supports E8-AC-ML1.1 by mandating that standard users cannot disable, bypass, or be exempted from application control, which preserves the effectiveness and coverage of the control. ISM-0846 is governance/enforcement hardening around the control, while E8-AC-ML1.1 is the primary requirement to implement it.
This control supports ISM-1493.
ISM-1493 requires organisations to maintain and regularly verify software registers across devices, creating visibility of what executables/applications are present. E8-AC-ML1.1 requires application control to be implemented on workstations, which relies on defining and maintaining an understanding of authorised versus unauthorised software. ISM-1493 supports E8-AC-ML1.1 by providing the evidence base to build, validate and review allow lists, though application control is an enforcement mechanism that goes beyond maintaining a register.
This control supports ISM-1544.
E8-AC-ML1.1 requires application control on workstations so that only approved applications can run. ISM-1544 supports this by providing a concrete control input (Microsoft's recommended application blocklist) that can be used to strengthen workstation application control policy and enforcement. ISM-1544 is narrower in that it focuses on one vendor's blocklist rather than the full allow-listing capability implied by E8-AC-ML1.1.
This control depends on ISM-2149.
ISM-2149 requires a controlled, enforced allow-list of authorised RMM and remote access tools and the blocking of anything not authorised. This aligns with and supports E8-AC-ML1.1 because implementing application control on workstations is a common mechanism used to technically enforce the authorised tool list (e.g. only approved remote tools can execute). E8-AC-ML1.1 is broader, as it applies to all applications rather than being specific to RMM/remote access tooling governance.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML1.1 requires application control to be implemented on workstations, enforcing the authorisation part on one class of system.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.