Essential Eight AC-ML1.3 Ensure only approved applications and scripts can run
What it says
Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAllow only company-approved applications and scripts to run on work computers.
This control is about ensuring that only the applications and scripts specifically approved by your business can run on work computers. It's essential because if unauthorised programs manage to run, they could be harmful, like malicious software or viruses, putting your data and your business at risk.
Free. Save your status, tasks and notes.
Why it matters
If applications and scripts are not allowlisted, malware can run, leading to data compromise and operational disruption.
How to implement
The IT team should identify a list of approved applications and scripts necessary for business operations and regularly update this list to ensure it covers any changes in business requirements.
The system administrator should implement application control software, such as AppLocker for Windows systems, to enforce the list of approved applications.
This ensures that only software on the approved list can be executed.
Security officers should conduct regular reviews of application usage logs to identify and evaluate any attempts to run unauthorised applications.
This can help to spot potential threats early.
IT staff should provide training for employees about the importance of this control and how sticking to approved applications helps keep the organisation's data safe.
The system administrator should ensure that application control policies are applied not just system-wide, but also specifically to user profile directories and temporary folders, as these are common targets for malicious activity.
Keep it running
Maintain application control rules for executables, DLLs and scripts; review events and update allowlists promptly when approved tools change.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Has an application control solution been implemented on all workstations?
Look at
Review configuration reports from tools like AppLocker or a third-party application control solution.
Good evidence
The organisation has a documented policy and a report showing application control is active on all workstations.
- Check 2 of 2What an auditor asks for
Ask for
Are application control policies applied to user profiles and temporary folders?
Look at
Check policy configurations or logs that apply specifically to user directories and temporary locations.
Good evidence
Logs demonstrate enforcement of application control policies in sensitive file directories, preventing unauthorised file execution.
Mappings
Closest match in ASD Information Security Manual: ISM-1657, Restrict application execution to approved set, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.18.
Annex A 8.18 requires restricting and tightly controlling utilities that can override system and application controls to prevent unauthorised changes on operational systems. E8-AC-ML1.3 implements application control so only approved applications and scripts (including installers) can run, which directly reduces the ability to execute unapproved installers or admin tools. E8-AC-ML1.3 is broader as a general execution control baseline, while Annex A 8.18 is focused on controlling powerful utility programs and their use.
ASD Information Security Manual: 17 mappings
This control is equivalent to ISM-1657.
E8-AC-ML1.3 requires application control to restrict execution of executables, libraries, scripts, installers, and similar content to an organisation-approved set. ISM-1657 states the same requirement with the same object types and intent, restricting execution to an approved set.
This control is broader than ISM-1658.
E8-AC-ML1.3 mandates application control so that only organisation-approved applications and scripts, including executables and libraries, can run. ISM-1658 applies the same concept to drivers, a narrower subset of executable code, under broader E8-AC-ML1.3.
This control partially meets ISM-0863.
ISM-0863 requires that provisioned mobile devices prevent personnel from installing non-approved mobile applications. E8-AC-ML1.3 requires application control to restrict execution of software (including installers) to an organisation-approved set, which is a broader application control objective that can include (but is not limited to) mobile app installation restrictions. ISM-0863 is specifically about mobile app installation on mobile devices, whereas E8-AC-ML1.3 covers execution control across many artefact types and environments.
This control partially meets ISM-1491.
ISM-1491 requires organisations to prevent unprivileged users from running specific script execution engines (such as PowerShell, cmd.exe, wmic.exe, mshta.exe, Windows Script Host). E8-AC-ML1.3 requires application control to restrict execution of executables, libraries and scripts (including compiled HTML/HTML applications) to an approved set, which is a broader mechanism that can be used to enforce the ISM-1491 restrictions. ISM-1491 is focused on a defined set of built-in scripting/command hosts and the unprivileged-user condition, whereas E8-AC-ML1.3 covers a wider universe of application/script execution controls across the environment.
This control partially overlaps ISM-0341.
ISM-0341 requires disabling automatic execution features for removable media to stop automatic program launch on insertion. E8-AC-ML1.3 restricts what executables, scripts, and installers can run to an approved set, which mitigates malicious execution even if content is introduced via removable media. They overlap in reducing the likelihood of untrusted code running from removable media, but E8-AC-ML1.3 is broader application execution control while ISM-0341 is specifically about AutoRun/AutoPlay behaviour.
This control partially overlaps ISM-0843.
ISM-0843 requires application control to be implemented on workstations. E8-AC-ML1.3 extends that concept by specifying that application control must restrict many content types (executables, libraries, scripts, installers, etc.) to an organisation-approved set. ISM-0843 establishes the foundational control, while E8-AC-ML1.3 clarifies a more detailed and comprehensive application control enforcement expectation.
This control partially overlaps ISM-1235.
E8-AC-ML1.3 requires preventing unapproved execution by allowing only an organisation-approved set of applications and scripts to run. ISM-1235 restricts unapproved code in add-ons, extensions, and plug-ins within common applications.
This control partially overlaps ISM-1592.
ISM-1592 requires that unprivileged users cannot install unapproved applications. E8-AC-ML1.3 overlaps by restricting execution of installers and other code to an organisation-approved set, which directly impedes users from running unauthorised installers even if they can write them to disk. ISM-1592 focuses on the ability to install (often tied to privilege/permission and software approval), while E8-AC-ML1.3 is broader in covering execution of many code types beyond installation activity.
This control partially overlaps ISM-1622.
ISM-1622 requires PowerShell to run in Constrained Language Mode to limit what PowerShell scripts and commands can do. E8-AC-ML1.3 requires application control so only approved applications and scripts can execute. They overlap in reducing malicious script execution, but ISM-1622 constrains PowerShell capability even when it runs, while E8-AC-ML1.3 is an allow-list control across many executable/script types beyond PowerShell.
This control partially overlaps ISM-1668.
ISM-1668 requires Microsoft Office to be blocked from creating executable content. E8-AC-ML1.3 is a broader application control that restricts execution of executables and scripts to an organisation-approved set across the environment, which can contain the impact even if malicious executables are created. ISM-1668 focuses on a specific Office hardening measure, while E8-AC-ML1.3 covers multiple applications and execution locations beyond Microsoft Office.
This control partially overlaps ISM-2115.
ISM-2115 requires server application extensions to be restricted to an organisation-approved set to prevent unauthorised add-ons from being installed or executed. E8-AC-ML1.3 similarly enforces allow-listing by restricting executables, libraries and scripts to an approved set, which can include extension modules depending on the platform. The overlap is strongest where extensions are implemented as loadable libraries or plugins governed by application control, but E8-AC-ML1.3 is broader than extensions and applies across many file types and endpoints, while ISM-2115 is specifically about server application extensions.
- ISM-2149Develop, enforce and maintain an authorised RMM and remote access tool listPartially overlaps
This control partially overlaps ISM-2149.
ISM-2149 requires organisations to maintain an authorised list of RMM and remote access tools and enforce it by blocking unauthorised tools. This supports E8-AC-ML1.3 because restricting execution to an organisation-approved set of executables, scripts and libraries is a practical way to implement the ISM-2149 authorised-tool requirement. E8-AC-ML1.3 is wider in scope (all code artefacts), while ISM-2149 is narrower and tool-category specific (RMM/remote access).
This control supports ISM-0955.
E8-AC-ML1.3 requires that only approved applications and scripts can run using application control. ISM-0955 specifies acceptable technical methods for implementing application control, providing implementation detail for E8-AC-ML1.3.
This control supports ISM-1392.
E8-AC-ML1.3 requires application control to restrict execution to an organisation-approved set. ISM-1392 adds a requirement to ensure only approved users can modify approved files and write to approved folders, enhancing control integrity and supporting E8-AC-ML1.3.
This control supports ISM-1471.
ISM-1471 requires that when implementing application control using publisher certificate rules, organisations use publisher names and product names to define what is allowed to run. This supports E8-AC-ML1.3 by providing a practical, scalable rule-construction method for restricting executables, libraries, scripts and other code types to an organisation-approved set. E8-AC-ML1.3 sets the overarching execution restriction outcome, while ISM-1471 is a specific technique for expressing and maintaining those allow/deny decisions.
This control depends on ISM-0846.
E8-AC-ML1.3 requires restricting execution to an organisation-approved set through application control. ISM-0846 strengthens this by ensuring normal users cannot disable or bypass application control, preserving enforcement of E8-AC-ML1.3.
This control depends on ISM-1870.
ISM-1870 requires application control coverage specifically for user profiles and temporary folders used by operating systems, web browsers and email clients. E8-AC-ML1.3 establishes the foundational requirement to restrict execution of applications and scripts to an organisation-approved set across relevant content types. Implementing ISM-1870 in practice depends on having an application control capability and ruleset as described by E8-AC-ML1.3, with ISM-1870 then refining where it must be enforced.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML1.3 restricts execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set, enforcing the authorisation part.
- IT.PRO-07.2Restrict administrative and management tools to approved sets and authorised locationsPartially overlaps
This control partially overlaps IT.PRO-07.2.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; E8-AC-ML1.3 restricts execution of executables, libraries, scripts, installers and similar file types to an organisation-approved set, which covers such tooling but not where it runs from.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.