Essential Eight AC-ML3.3 Microsoft's vulnerable driver blocklist is implemented
What it says
Microsoft's vulnerable driver blocklist is implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse Microsoft's blocklist to stop vulnerable drivers from running.
This control means using Microsoft's list of blocked drivers to protect your computer systems. Vulnerable drivers can let bad actors take control of your devices, so it's essential to block them. This step helps keep your business safe from potential harm caused by malicious software.
Free. Save your status, tasks and notes.
Why it matters
Without this blocklist, compromised systems may run malicious drivers, risking data breaches and operational disruption.
How to implement
The IT team should review all currently installed drivers on company devices to ensure none are on the vulnerable list.
This can be done using Microsoft's tools to compare the list of installed drivers against the blocklist.
The system administrator should update all company computers to ensure they receive the latest Microsoft blocklists.
This involves configuring the system settings to automatically update driver policies.
The security officer should regularly check for updates to Microsoft's blocklist and implement these updates across the organisation.
This can be done by setting a schedule to download and verify the latest blocklists from Microsoft.
IT staff should configure the application control solutions like AppLocker or Windows Defender to enforce the Microsoft blocklist.
This involves setting the correct rules within the software to ensure blocked drivers cannot be executed.
The IT department should ensure that all application control policies are enforced on all devices, including workstations and servers, to prevent unauthorised driver execution.
Keep it running
Regularly check for updates to Microsoft's vulnerable driver blocklist so newly identified risky drivers are blocked promptly.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Have all devices in the organisation implemented Microsoft's vulnerable driver blocklist?
Look at
Examine the system configuration settings and policies related to driver control.
Good evidence
Systems show active settings that align with the latest Microsoft driver blocklist policy.
- Check 2 of 3What an auditor asks for
Ask for
How frequently are updates to the blocklist applied across the organisation?
Look at
Review logs or policy change records that show scheduled updates are applied.
Good evidence
Records indicate blocklist updates are applied within a week of release.
- Check 3 of 3What an auditor asks for
Ask for
What procedures are in place to check for compliance?
Look at
Check audit logs or compliance reports showing the enforcement of the blocklist.
Good evidence
Audit logs detail regular checks and confirm compliance across all devices.
Mappings
Closest match in ASD Information Security Manual: ISM-1659, Implement Microsoft's vulnerable driver blocklist, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.8.
E8-AC-ML3.3 requires a specific measure: enabling Microsoft's vulnerable driver blocklist to reduce exposure to driver vulnerabilities. ISO/IEC 27001:2022 Annex A 8.8 requires obtaining information about technical vulnerabilities, evaluating exposure, and applying appropriate measures across information systems generally. E8-AC-ML3.3 is a concrete technical implementation that can be selected as one 'appropriate measure' under Annex A 8.8, but Annex A 8.8 is much broader in scope and method.
This control partially meets A.8.19.
E8-AC-ML3.3 requires implementing Microsoft's vulnerable driver blocklist to stop vulnerable drivers from running on Windows systems. ISO/IEC 27001:2022 Annex A 8.19 supports this by requiring secure software installation procedures, which can include controls to restrict or validate driver installation and reduce exposure to malicious or vulnerable drivers. Annex A 8.19 is procedural and technology-agnostic, while E8-AC-ML3.3 is a specific Microsoft platform enforcement mechanism.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1659.
E8-AC-ML3.3 requires organisations to implement Microsoft's vulnerable driver blocklist to prevent known vulnerable drivers from loading on Windows systems. ISM-1659 states the same requirement to implement Microsoft's vulnerable driver blocklist. Both controls have the same technical intent and implementation focus (blocking vulnerable kernel drivers) with no material difference in scope.
This control partially overlaps ISM-0298.
E8-AC-ML3.3 requires implementing Microsoft's vulnerable driver blocklist to prevent execution of known vulnerable drivers. ISM-0298 requires a centralised, managed approach to patch or update applications, operating systems, drivers and firmware and to verify successful application. They overlap in managing driver-related risk, but E8-AC-ML3.3 is an execution-prevention control while ISM-0298 is a lifecycle maintenance/patching control that does not necessarily enforce runtime blocking.
This control partially overlaps ISM-1492.
E8-AC-ML3.3 requires implementing Microsoft's vulnerable driver blocklist to prevent exploitation via known vulnerable kernel drivers. ISM-1492 relates by requiring operating system exploit protection to be enabled, which can mitigate exploitation techniques (including some privilege escalation paths) even if a vulnerable driver is present. The blocklist prevents specific drivers from loading, whereas exploit protection is a broader OS hardening measure and may not stop a vulnerable driver from being installed or started.
This control partially overlaps ISM-1703.
E8-AC-ML3.3 requires organisations to implement Microsoft's vulnerable driver blocklist to stop known vulnerable drivers from running. ISM-1703 relates by requiring regular vulnerability scanning to identify missing patches or updates for driver vulnerabilities, which helps discover and remediate the same class of driver risk that the blocklist mitigates at runtime. The blocklist is an execution prevention control, whereas ISM-1703 is a detection/assessment control and does not by itself prevent a vulnerable driver from loading.
This control depends on ISM-1697.
ISM-1697 requires patching non-critical driver vulnerabilities within one month when no working exploits exist. E8-AC-ML3.3 supports ISM-1697 by reducing exposure to known vulnerable drivers through Microsoft's vulnerable driver blocklist, acting as an additional vendor mitigation when patching is pending or unavailable. The blocklist is a different control mechanism than patching and does not replace the one-month remediation requirement in ISM-1697.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.1Restrict execution to supported, verified and authorised software with time-bound exceptionsPartially overlaps
This control partially overlaps IT.PRO-07.1.
IT.PRO-07.1 requires that only supported, verified and organisation-authorised software can execute; E8-AC-ML3.3 requires Microsoft's vulnerable driver blocklist to be implemented, a narrower measure that blocks the vulnerable drivers on that list.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.