Essential Eight AC-ML2.2 Application control excludes user profiles and temporary folders
What it says
Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure application control is in place everywhere except user profiles and temp folders.
This control is about making sure that only approved software can run on your computers, except in some specific areas like user profiles and temporary folders. Without this control, unwanted software or viruses could sneak in and cause harm, like slowing down your systems or stealing important information.
Free. Save your status, tasks and notes.
Why it matters
If application control doesn't cover user profiles and OS/browser/email temp folders, attackers can run malware from these paths, leading to data loss and outages.
How to implement
The IT team should review and configure application control settings to exclude user profiles and temporary folders on your computers, ensuring that application restrictions are set up everywhere else.
System administrators should regularly update the list of approved software the organisation uses to ensure only necessary programs are allowed to run.
Security officers need to work with the IT team to establish procedures for handling requests for new software to be added to the approved list, ensuring it's safe before approval.
The IT team should utilise tools like Microsoft's AppLocker or another third-party application control solution to help manage and enforce these rules.
Keep it running
Regularly review allow/deny rules and logs for user profile and browser/email temp paths, and confirm common temp locations can't be used to launch executables.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Have all team members been informed about application control policies and their exclusions?
Look at
Verify training records or email communications about the current application control policy.
Good evidence
Staff have received regular updates and training on application control policies, and relevant communication records are available.
- Check 2 of 2What an auditor asks for
Ask for
Are application control settings correctly configured to exclude only user profiles and temporary folders in the system?
Look at
Examine the configuration settings, particularly the paths included and excluded in the application control policy.
Good evidence
Configuration settings only exclude user profiles and temporary folders, and these settings are reviewed regularly.
Mappings
Closest match in ASD Information Security Manual: ISM-1871, Implement application control exclusions for system areas, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.18.
Annex A 8.18 requires restrictions and tight control over utilities that can override system and application controls, which includes preventing unauthorised execution paths on operational systems. E8-AC-ML2.2 relates by applying application control broadly and explicitly excluding user profiles and temporary folders, reducing the ability to execute installers or utility programs from common user-writable locations. However, Annex A 8.18 is focused on controlling powerful utilities and administrative override capability, whereas E8-AC-ML2.2 is primarily about execution control coverage across filesystem locations rather than privileged utility governance.
This control partially overlaps A.8.19.
E8-AC-ML2.2 specifies control with folder exclusions, whereas Annex A 8.19 involves managing software installation security. Both address unauthorised code execution but differ in exclusion details.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1871.
ISM-1871 requires application control to be applied to all locations except user profiles and temporary folders used by operating systems, web browsers, and email clients. E8-AC-ML2.2 states the same exclusion approach for application control with the same key locations and rationale. Both controls have matching scope and intent (implementing application control broadly while excluding high-churn user/temp paths).
This control partially meets ISM-0843.
E8-AC-ML2.2 requires application control to be applied across system locations, explicitly excluding user profiles and temporary folders used by operating systems, web browsers and email clients. ISM-0843 requires application control to be implemented on workstations, which is a platform-scoped requirement that would typically include applying controls across workstation execution paths. ISM-0843 does not express the specific location-based scoping/exclusions that E8-AC-ML2.2 mandates.
This control partially overlaps ISM-0846.
E8-AC-ML2.2 requires application control coverage across locations (with defined exclusions for user profiles and temporary folders). ISM-0846 requires that users (except local administrators and break glass accounts) cannot disable, bypass or be exempted from application control, which helps ensure the location-based enforcement in E8-AC-ML2.2 cannot be circumvented by standard users. E8-AC-ML2.2 is about where application control is applied, while ISM-0846 is about preventing user-driven weakening of that control.
This control partially overlaps ISM-0955.
ISM-0955 requires implementing application control using hash, publisher certificate, or path rules to control what can execute. E8-AC-ML2.2 specifies where application control must be applied by excluding user profiles and temporary folders from enforcement at that maturity level, which affects the scope of application control deployment. ISM-0955 is about rule types and does not define location-based exclusions, while E8-AC-ML2.2 is primarily about coverage boundaries rather than rule mechanics.
This control partially overlaps ISM-1657.
ISM-1657 requires application control that restricts execution to an organisation-approved set of executable artefacts. E8-AC-ML2.2 requires application control be applied to all locations other than user profiles and temporary folders, which is a particular scoping decision about where enforcement occurs. They overlap because both are about implementing execution control, but ISM-1657 is agnostic about location scoping while E8-AC-ML2.2 focuses on enforcement coverage decisions rather than the approved-set definition itself.
This control supports ISM-1544.
ISM-1544 requires implementing Microsoft's recommended application blocklist to block known undesirable/unauthorised applications. E8-AC-ML2.2 requires application control to be applied broadly (to all locations other than user profiles and temporary folders), and the Microsoft blocklist can be embedded within those rules to improve blocking effectiveness. E8-AC-ML2.2 is primarily about ruleset coverage by location, while ISM-1544 is about adopting Microsoft's recommended block content.
This control depends on ISM-1392.
E8-AC-ML2.2 requires broad application control with folder exclusions. ISM-1392 complements by ensuring only approved users can modify files, reducing risks like path-rule bypass.
This control depends on ISM-1490.
ISM-1490 requires implementing application control on internet-facing servers. E8-AC-ML2.2 refines how application control is applied by excluding user profiles and temporary folders, which affects the effectiveness and operational design of application control rules. E8-AC-ML2.2 supports ISM-1490 by providing a specific scoping approach for rulesets, but ISM-1490 does not mandate this particular location-based treatment.
This control depends on ISM-1656.
ISM-1656 requires application control to be implemented on non-internet-facing servers to stop unapproved code from running. E8-AC-ML2.2 specifies how application control is applied across locations (excluding user profiles and temporary folders), which influences the effectiveness and coverage of application control where it is implemented. It supports ISM-1656 by guiding deployment scope decisions for application control, but it is not the same requirement as implementing it on non-internet-facing servers.
This control depends on ISM-1746.
E8-AC-ML2.2 enforces control excluding certain folders, while ISM-1746 maintains file system integrity, preventing unauthorised permission changes, supporting application control effectiveness.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML2.2 applies application control to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients, enforcing the authorisation part in the remaining locations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.