Essential Eight AC-ML2.3 Microsoft's recommended application blocklist is implemented
What it says
Microsoft's recommended application blocklist is implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImplement Microsoft's recommended blocklist to enhance security.
This control is about using Microsoft's recommended list to block certain applications from running on your systems. It's like having a bouncer at the door to stop unwanted guests from entering your party. If you don't have this, harmful programs could run and damage your data or steal sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without Microsoft's recommended blocklist, known malicious or unwanted apps can run, increasing risk of compromise and data loss.
How to implement
IT team should ensure the application's blocklist is updated.
Review and apply Microsoft's recommended blocklist to your systems to prevent unauthorised software execution.
System administrator should implement blocklist on all workstations.
Use Windows settings to apply blocklist policies to control what applications can be executed.
Security officer should verify compliance of the blocklist.
Regularly check that the blocklist is consistently applied across all devices.
IT team should document the blocklist implementation process.
Keep a step-by-step record of how the blocklist is set up and maintained for future reference.
System administrator should perform regular updates.
Schedule routine checks and updates of the blocklist as Microsoft releases new security recommendations.
IT team should train staff on security practices.
Educate employees on the importance of application control and why certain applications are blocked.
Keep it running
Import Microsoft's recommended block rules into WDAC/AppLocker, test in audit mode, then enforce; review and update rules after patch cycles.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Has the organisation implemented Microsoft's recommended blocklist on all systems?
Look at
Review system settings and policy configurations for blocklist implementations.
Good evidence
Blocklist settings reflect Microsoft's latest recommendations and are applied consistently across all workstations.
- Check 2 of 2What an auditor asks for
Ask for
How often is the blocklist updated and reviewed?
Look at
Check logs or records of updates and reviews of the blocklist.
Good evidence
The blocklist is updated whenever new recommendations are issued by Microsoft, with documented logs of each update.
Mappings
Closest match in ASD Information Security Manual: ISM-1544, Implement Microsoft's application blocklist, which asks for the same thing.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1544.
E8-AC-ML2.3 requires organisations to implement Microsoft's recommended application blocklist to prevent execution of known risky/abusable applications. ISM-1544 states the same requirement: that Microsoft's recommended application blocklist is implemented. The scope and intent align closely, with both focused on using Microsoft's curated blocklist as an application control hardening measure.
This control partially meets ISM-0843.
E8-AC-ML2.3 requires implementing Microsoft's recommended application blocklist as part of controlling what can run in the environment. ISM-0843 requires application control to be implemented on workstations, which is a broader foundational control that can include (but is not limited to) applying Microsoft's blocklist. E8-AC-ML2.3 is a specific implementation detail within a wider workstation application control capability described by ISM-0843.
This control partially meets ISM-1657.
E8-AC-ML2.3 requires implementing Microsoft's recommended application blocklist to block known unwanted applications. ISM-1657 requires application control that restricts execution of executables, libraries, scripts, installers and related content to an organisation-approved set, which is a broader allowlisting/denylisting regime. Microsoft's blocklist in E8-AC-ML2.3 is one specific mechanism that can be used within the broader execution restriction approach of ISM-1657.
This control partially overlaps ISM-1601.
ISM-1601 requires implementation of Microsoft ASR rules to reduce the attack surface on endpoints. E8-AC-ML2.3 relates because Microsoft's recommended application blocklists (e.g. Defender blocklists) and ASR both prevent execution of known-bad or risky behaviours. However, blocklists focus on restricting specific applications/artifacts, while ISM-1601 focuses on ASR behavioural rules (e.g. process creation, script abuse) that are not limited to a named app list.
This control partially overlaps ISM-1659.
E8-AC-ML2.3 requires implementing Microsoft's recommended application blocklist to prevent execution of risky user-mode applications. ISM-1659 requires implementing Microsoft's vulnerable driver blocklist, which similarly uses Microsoft-curated deny rules but targets kernel drivers to reduce privilege escalation and kernel compromise. They overlap in using Microsoft-maintained blocklists as preventative controls, but they cover different artefact types (applications versus drivers) and mitigate different attack paths.
This control depends on ISM-0955.
E8-AC-ML2.3 requires implementing Microsoft's recommended application blocklist, which depends on having an application control mechanism capable of enforcing block rules. ISM-0955 specifies implementation methods for application control (e.g. cryptographic hash, publisher certificate, or path rules) that provide the enforcement basis needed to apply a blocklist. Without the capabilities described in ISM-0955, E8-AC-ML2.3 cannot be consistently enforced across systems.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML2.3 requires Microsoft's recommended application blocklist to be implemented, a supporting measure that blocks the applications on that list.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.