Essential Eight AC-ML2.4 Annual validation of application control rulesets
What it says
Application control rulesets are validated on an annual or more frequent basis.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck once a year or more that rules for allowing or blocking software are accurate.
Once a year or more often, it's essential to check that the rules for which software can run on your organisation's computers are still correct. This is important because if you don't, malicious or unapproved software could run and cause significant harm, like stealing sensitive information or damaging files.
Free. Save your status, tasks and notes.
Why it matters
If application control rulesets aren't validated at least annually, outdated allow rules may permit malicious executables, enabling compromise, data theft or system damage.
How to implement
The IT manager should schedule an annual review of all the application control rules to ensure they are up-to-date.
The IT team should use a tool, like Microsoft's AppLocker, to export and review current rulesets against approved applications.
The system administrator should update the ruleset to include any new approved applications and remove those that are no longer necessary.
The security officer should document any changes made to the application control rules as part of the organisation's security policy.
The IT team should conduct training for employees to inform them about any changes to the software they are allowed to use.
Keep it running
Validate application control rulesets at least annually: review allow/deny rules, remove obsolete entries, confirm business apps still function, and update rules to reflect current software and threats.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
When was the last time the application control ruleset was reviewed?
Look at
Examine the documented schedule and records of reviews of the application control ruleset.
Good evidence
Reviews have been conducted at least annually, with records showing the dates and any updates made.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation verify that only approved applications are running?
Look at
Check logs from tools like AppLocker or similar controls for evidence of application usage.
Good evidence
Logs show that only approved applications have been executed over the past year.
Mappings
Closest match in ASD Information Security Manual: ISM-1582, Annual validation of application control rulesets, which asks for the same thing.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1582.
ISM-1582 requires application control rulesets to be validated on an annual or more frequent basis. E8-AC-ML2.4 states the same requirement for annual (or more frequent) validation of application control rulesets. The scope and intent align directly, with both focused on routine review to keep allow/deny rules current.
This control partially overlaps ISM-1676.
E8-AC-ML2.4 requires organisations to validate their application control rulesets annually or more frequently. ISM-1676 similarly requires annual validation, but it is specific to Microsoft Office trusted publishers (a particular trust/allow mechanism) rather than the whole application control ruleset. The overlap is the periodic validation of allow-listing decisions, while ISM-1676 is narrower in technology and focus than E8-AC-ML2.4.
This control supports ISM-0843.
E8-AC-ML2.4 requires application control rulesets to be validated at least annually to ensure allow/deny rules remain accurate and effective. ISM-0843 requires that application control is implemented on workstations, providing the foundational control mechanism whose rulesets then need periodic validation under E8-AC-ML2.4. ISM-0843 focuses on implementation presence/scope, while E8-AC-ML2.4 focuses on the ongoing governance and correctness of the rules over time.
This control supports ISM-0955.
E8-AC-ML2.4 requires application control rulesets to be validated on an annual or more frequent basis to confirm the allow/block logic remains accurate. ISM-0955 specifies acceptable technical methods for implementing application control rules (e.g. hash, publisher certificate, path rules), which directly influences what is being validated under E8-AC-ML2.4. ISM-0955 is about rule construction/implementation approach, whereas E8-AC-ML2.4 is about periodic verification that those implemented rules still reflect authorised software and business requirements.
This control depends on ISM-1657.
ISM-1657 requires restricting application execution to an organisation-approved set, which depends on the quality and currency of the allowlist/rules. E8-AC-ML2.4 requires application control rulesets to be validated at least annually, helping ensure the ISM-1657 approved set remains accurate and effective over time. The candidate is governance/assurance for the rules rather than the core execution restriction requirement.
This control depends on ISM-1658.
ISM-1658 requires application control to restrict the execution of drivers to an organisation-approved set. E8-AC-ML2.4 mandates validating application control rulesets at least annually, which helps ensure the approved-driver allowlist/deny rules used to meet ISM-1658 remain accurate and effective over time. The candidate is about governance/assurance of rulesets, whereas ISM-1658 is the specific driver execution restriction outcome.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.3Detect and remediate configuration drift using scheduled assessments and automated monitoringPartially overlaps
This control partially overlaps IT.PRO-04.3.
IT.PRO-04.3 requires detecting and responding to configuration drift via scheduled assessments and, where supported, automated monitoring; E8-AC-ML2.4 requires application control rulesets to be validated at least annually, a scheduled assessment of one specific configuration.
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute, with exceptions regularly reviewed; E8-AC-ML2.4 requires application control rulesets to be validated at least annually, overlapping on periodic review of what may run.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.