Skip to content
Application control
Essential EightE8-AC-ML3.1

Essential Eight AC-ML3.1 Application control is implemented on non-internet-facing servers

What it says

Application control is implemented on non-internet-facing servers.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure only approved software can run on internal servers.

This control ensures that only software approved by your organisation can run on internal servers that do not face the internet. It matters because unauthorised or harmful software on these servers can lead to data theft, disruptions, or security breaches. Controlling what runs on these servers protects sensitive information and keeps systems secure.

Why it matters

Without application control, unauthorised software on internal servers can lead to data leaks and compromise critical business operations.

How to implement

  1. The IT team should create a list of approved software for non-internet-facing servers.

    To do this, review the software currently used and needed for operations and mark those as approved.

  2. A system administrator should implement application control software on non-internet-facing servers.

    This is done by configuring tools like AppLocker or similar to block any software not on the approved list.

  3. Security officers should regularly review and update the list of approved software.

    Do this by meeting quarterly with department heads to ensure the list meets current needs and security policies.

  4. The IT team should set up alerts for any attempts to run unapproved software.

    Use monitoring tools to ensure notifications are sent immediately to the security team if there is suspicious activity.

Keep it running

Maintain an allow-list for non-internet-facing servers, review it regularly, and alert on any execution outside approved applications.

Evidence and audit

  1. Check 1 of 3What an auditor asks for

    Ask for

    Is there an approved list of software for non-internet-facing servers?

    Look at

    Review the software approval document.

    Good evidence

    A comprehensive and current list of approved software should be provided.

  2. Check 2 of 3What an auditor asks for

    Ask for

    How are application controls configured on non-internet-facing servers?

    Look at

    Check the application control settings and rules.

    Good evidence

    The settings should match the list of approved software, blocking all others.

  3. Check 3 of 3What an auditor asks for

    Ask for

    How often is the list of approved software updated?

    Look at

    Examine the update logs or meeting notes.

    Good evidence

    Evidence of quarterly reviews and updates to the approved software list should be present.

Mappings

Closest match in ASD Information Security Manual: ISM-1656, Implement application control on secure servers, which asks for the same thing.

ASD ISM

ASD Information Security Manual: 9 mappings

  • ISM-1656Implement application control on secure serversEquivalent
  • ISM-0955Implementing application control measuresBroader than
  • ISM-1490Implement application control on internet-facing serversPartially overlaps
  • ISM-1657Restrict application execution to approved setPartially overlaps
  • ISM-1658Restrict execution of drivers via application controlPartially overlaps
  • ISM-1871Implement application control exclusions for system areasPartially overlaps
  • ISM-1544Implement Microsoft's application blocklistSupports
  • ISM-1926Restrict identity servers to their designed role onlySupports
ASD Essentials

ASD Essentials for enterprise IT: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.