Essential Eight AC-ML2.1 Application control is implemented on internet-facing servers
What it says
Application control is implemented on internet-facing servers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only approved applications can run on servers accessible from the internet.
This control is about making sure that only software you have approved can run on servers that people outside your organisation can access via the internet. This matters because if random or harmful programs can run on these servers, it opens the door to cyber attackers who might steal information, cause disruption, or damage your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without application control on internet-facing servers, attackers can run unauthorised executables or scripts, enabling initial access, web shell deployment and data exfiltration.
How to implement
IT team should review and document all current software on internet-facing servers to ensure it's approved, by conducting a software inventory.
System administrator should set up application control to allow only approved software to run, using tools like Microsoft AppLocker, by configuring rules that specify allowed applications.
Security officer should ensure that Microsoft's recommended blocklist is implemented to prevent running applications known to be harmful, by updating the application control policy with the latest blocklist.
IT team should document and review application control rules annually to keep them up-to-date with organisational changes, by scheduling regular updates and reviews.
System administrator should centrally log application control events to monitor what runs on the servers, by configuring logging settings in the application control solution.
Keep it running
Maintain a tested allowlist on each internet-facing server: review additions/changes after patching and deployments, and alert on any blocked execution attempts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation have a policy to approve and control software on internet-facing servers?
Look at
Examine the application control configurations and approved software lists.
Good evidence
There is a documented and current application control policy with a list of approved software that matches application control settings.
- Check 2 of 2What an auditor asks for
Ask for
How are application control event logs managed and analysed?
Look at
Review central logs for application control events and procedures for log analysis.
Good evidence
Logs are centrally stored, protected from unauthorised changes, and regularly reviewed for suspicious activities.
Mappings
Closest match in ASD Information Security Manual: ISM-1490, Implement application control on internet-facing servers, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.18.
E8-AC-ML2.1 requires application control on internet-facing servers to prevent unapproved code execution. ISO/IEC 27001:2022 Annex A 8.18 restricts use of utility programs that can override system and application controls, which reduces the likelihood that application control is bypassed on those servers. E8-AC-ML2.1 is about allowlisting/enforcement, whereas A 8.18 targets administrative tools that could defeat that enforcement.
This control partially overlaps A.8.19.
E8-AC-ML2.1 requires application control on internet-facing servers to prevent execution of unapproved software. ISO/IEC 27001:2022 Annex A 8.19 requires procedures and measures to securely manage software installation on operational systems, which can include restricting installations to approved software and controlled deployment. The overlap is in controlling what software can be introduced/run, but A 8.19 is process-oriented across systems generally, while E8-AC-ML2.1 is a specific technical enforcement on internet-facing servers.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1490.
E8-AC-ML2.1 requires application control to be implemented on internet-facing servers so only approved applications can execute. ISM-1490 states the same requirement for internet-facing servers and is effectively a direct ISM expression of the Essential Eight control. Both focus on preventing unauthorised code execution on exposed servers through application control.
This control partially overlaps ISM-1656.
ISM-1656 requires application control to be implemented on non-internet-facing servers to reduce execution of unauthorised software in server environments. E8-AC-ML2.1 also requires application control, but it applies to internet-facing servers rather than non-internet-facing servers. They overlap on the same technical mechanism (application control on servers), but each addresses a different server exposure profile and neither fully satisfies the other's scope.
This control partially overlaps ISM-1657.
E8-AC-ML2.1 requires application control on internet-facing servers to ensure only approved applications run. ISM-1657 supports this by defining what application control should restrict (executables, libraries, scripts, installers and other code types) to an organisation-approved set. ISM-1657 is more specific about the coverage of file types, while E8-AC-ML2.1 is focused on the internet-facing server scope.
This control partially overlaps ISM-1658.
E8-AC-ML2.1 requires application control on internet-facing servers to prevent unauthorised code from running. ISM-1658 supports this objective by requiring application control to restrict drivers to an organisation-approved set, reducing kernel-level execution risk on those servers. ISM-1658 is a narrower technical subset (drivers specifically) compared with the broader execution control implied by E8-AC-ML2.1.
This control partially overlaps ISM-1871.
ISM-1871 defines where application control should and should not be applied, specifically excluding user profiles and temporary folders. E8-AC-ML2.1 requires implementing application control on internet-facing servers, which is a deployment scope that would need to follow the location-scoping rules in ISM-1871 when implemented. The candidate is about where to deploy application control, while ISM-1871 is about how to scope it within systems.
This control partially overlaps ISM-2115.
ISM-2115 requires restricting server application extensions to an organisation-approved set to reduce the attack surface on servers. E8-AC-ML2.1 supports this by mandating application control on internet-facing servers, which provides a technical mechanism to prevent unapproved extension binaries or plugin components from executing. E8-AC-ML2.1 is about where application control must be implemented, whereas ISM-2115 is about governing the specific class of 'extensions' within server applications.
This control supports ISM-0955.
E8-AC-ML2.1 requires application control to be implemented on internet-facing servers. ISM-0955 supports this by specifying recognised implementation methods (cryptographic hash, publisher certificate, or path rules) that can be used to realise application control on those servers. E8-AC-ML2.1 sets the outcome and scope, while ISM-0955 provides acceptable technical mechanisms.
This control depends on ISM-1392.
E8-AC-ML2.1 requires application control on internet-facing servers, often relying on allow rules to constrain what can run. ISM-1392 is a prerequisite safeguard when path rules are used, ensuring only approved users can modify approved files and write to approved folders so attackers cannot bypass application control by dropping or altering binaries in allowed paths. E8-AC-ML2.1 can be implemented without path rules, but where path rules are used this control becomes foundational.
This control depends on ISM-1746.
E8-AC-ML2.1 requires application control on internet-facing servers to limit execution to approved applications. ISM-1746 is a prerequisite where path rules are used, ensuring only approved users can change file system permissions for approved files and folders so application control cannot be subverted by permission changes. This is conditional dependency: it is essential for secure path-rule deployments but not mandatory for hash- or publisher-based approaches.
This control depends on ISM-2149.
ISM-2149 requires an enforced authorised list of RMM and remote access tools to prevent unauthorised remote control capability. This supports E8-AC-ML2.1 because application control on internet-facing servers can be used to ensure only approved remote administration tooling (including any authorised RMM agents) can execute on those servers. E8-AC-ML2.1 is broader, focusing on all application execution on internet-facing servers rather than specifically governing RMM/remote access tool authorisation.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML2.1 requires application control to be implemented on internet-facing servers, enforcing the authorisation part on one class of system.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.