Essential Eight AC-ML1.2 Application control is applied to user profiles and temporary folders

This control is equivalent to ISM-1870.

ISM-1870 requires application control to be applied to user profiles and temporary folders used by operating systems, web browsers and email clients. E8-AC-ML1.2 states the same requirement with the same locations and technology focus. Both controls are aligned in scope and intent, preventing execution from user-writable and temporary paths commonly abused by malware.

This control partially meets ISM-0843.

E8-AC-ML1.2 requires organisations to apply application control specifically to user profiles and temporary folders used by operating systems, web browsers and email clients. ISM-0843 is broader, requiring application control to be implemented on workstations generally, which would typically include (but is not limited to) controls for user profile and temp locations. E8-AC-ML1.2 is a specific coverage expectation within the more general workstation application control requirement in ISM-0843.

This control partially meets ISM-1635.

ISM-1635 requires system owners to implement controls that protect each system and its operating environment. E8-AC-ML1.2 specifies an application control coverage requirement to reduce execution of unauthorised code in common writeable paths. ISM-1635 is broader because it includes all relevant environmental controls, not only application control placement decisions.

This control partially meets ISM-1657.

E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders used by operating systems, browsers and email clients. ISM-1657 is broader, defining the application control objective of restricting execution of multiple content types (executables, libraries, scripts, installers and more) to an organisation-approved set, regardless of where they are located. E8-AC-ML1.2 is a specific scoping requirement about including user and temp paths within an application control program as described more generally by ISM-1657.

This control partially overlaps ISM-0382.

E8-AC-ML1.2 requires application control coverage for user profiles and temporary folders to stop unapproved execution from common user-writable locations. ISM-0382 overlaps by ensuring unprivileged users cannot uninstall or disable approved applications, which helps maintain the integrity and effectiveness of enforced application control in those locations. ISM-0382 is about preventing user tampering with approved software, while E8-AC-ML1.2 is about enforcing execution control in specific folders regardless of user intent.

This control partially overlaps ISM-0955.

ISM-0955 requires organisations to implement application control using hash, publisher certificate, or path rules. E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders, which is a deployment scope decision for the same application control capability. ISM-0955 does not specify where enforcement must occur, while E8-AC-ML1.2 does not specify which rule types must be used.

This control partially overlaps ISM-1592.

E8-AC-ML1.2 requires application control in user profiles and temporary folders to prevent unapproved software from executing out of common user-writable locations. ISM-1592 overlaps by preventing unprivileged users from installing unapproved applications, which reduces the volume of unauthorised code that could later execute from user or temp directories. ISM-1592 addresses installation prevention, whereas E8-AC-ML1.2 addresses execution prevention in specific folders (including scenarios where code arrives without a formal install).

This control partially overlaps ISM-1658.

E8-AC-ML1.2 requires application control to cover user profiles and temporary folders to stop unapproved code running from those user-writable locations. ISM-1658 requires application control to restrict execution of drivers to an organisation-approved set, which is another application-control use case. Both rely on application control enforcement, but ISM-1658 is about driver execution (and kernel-level risk) rather than location-based coverage of user/temporary folders.

This control partially overlaps ISM-1871.

E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders used by operating systems, web browsers and email clients. ISM-1871 addresses application control scope by emphasising coverage of locations other than those user and temporary folders, effectively focusing on the remainder of the file system. They intersect on the topic of defining application-control coverage, but ISM-1871 is effectively the complement of E8-AC-ML1.2 rather than the same requirement.

This control supports ISM-0846.

E8-AC-ML1.2 requires enforcement of application control within user profiles and temporary folders to prevent users and malware running code from those writable locations. ISM-0846 supports this by ensuring standard users cannot disable, bypass or be exempted from application control, which is necessary to keep enforcement effective in user and temp paths. ISM-0846 focuses on preventing circumvention by users/accounts, while E8-AC-ML1.2 focuses on ensuring the risky directory locations are included in enforcement scope.

This control supports ISM-1392.

E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders, which are frequently writable and targeted for execution. ISM-1392 supports this by specifying that, where path rules are used, only approved users can modify approved files and write to approved folders, reducing bypass opportunities in user and temp locations. ISM-1392 is a hardening requirement for path-rule implementations, whereas E8-AC-ML1.2 is the coverage requirement for those risky directories.

This control supports ISM-1544.

E8-AC-ML1.2 requires application control to cover user profiles and temporary folders to block execution of unapproved software from those locations. ISM-1544 supports this by adopting Microsoft's recommended application blocklist, which strengthens what is denied even if malicious binaries are written into user or temp directories. ISM-1544 is focused on deny-list content, whereas E8-AC-ML1.2 is focused on ensuring the high-risk directories are actually enforced by application control.

This control supports ISM-1746.

E8-AC-ML1.2 requires application control in user profile and temporary folders to prevent unapproved execution from those common drop locations. ISM-1746 supports this by restricting who can change file system permissions on approved files and folders when using path rules, helping prevent attackers from weakening controls in user-writable or temporary paths. ISM-1746 is about protecting permissions and rule integrity, while E8-AC-ML1.2 is about ensuring those paths are in-scope for application control.

This control depends on ISM-1491.

ISM-1491 requires organisations to prevent standard users from launching key script execution engines that are commonly abused for execution. E8-AC-ML1.2 applies application control to user profiles and temporary folders, reducing the likelihood that users can run scripts or dropped binaries from common writeable paths even if an engine is available. E8-AC-ML1.2 does not itself mandate blocking the listed engines, but it strengthens the effectiveness of ISM-1491 by constraining common execution locations.

This control partially overlaps IT.PRO-07.1.

IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML1.2 applies application control to user profiles and temporary folders used by operating systems, web browsers and email clients, enforcing the authorisation part in those locations.