Essential Eight AH-ML2.1 Web browsers are hardened with the most restrictive guidance
What it says
Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishHarden web browsers using the strictest security settings from ASD or vendor guides.
Securing web browsers with strict settings is like locking all the doors and windows to keep your house safe. Without this control, cybercriminals could easily sneak in through those open doors and cause harm, such as stealing sensitive information or installing malware.
Free. Save your status, tasks and notes.
Why it matters
Without hardened web browsers (ASD/vendor baseline), insecure settings and add-ons increase drive-by compromise risk, enabling malware and credential theft.
How to implement
IT team should review current web browser settings using vendor and ASD guides to identify the most restrictive security options.
System administrator should apply the strictest security settings by accessing group policies for all company web browsers and updating them.
Security officer should regularly check for updates in security guidance from vendors and the ASD to ensure the organisation stays protected.
IT team should disable or remove weaker browsers like Internet Explorer 11 to prevent vulnerabilities.
Keep it running
Weekly verify browser policies match ASD and vendor hardening baselines; when guidance conflicts, implement the most restrictive setting and document exceptions.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How is web browser hardening configured in the organisation?
Look at
Examine the group policy settings for web browsers or configuration management systems.
Good evidence
Group policy settings should show that the most restrictive security configurations are applied uniformly across all browsers.
- Check 2 of 2What an auditor asks for
Ask for
Are users able to change security settings in their web browsers?
Look at
Verify the settings are greyed out to the end-users, indicating locked configurations.
Good evidence
The browser settings should be locked down with no ability for users to alter them.
Mappings
Closest match in ASD Information Security Manual: ISM-1412, Web browser hardening with strict guidelines, which asks for the same thing.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1412.
E8-AH-ML2.1 requires web browsers to be hardened using ASD and vendor hardening guidance, applying the most restrictive settings where guidance conflicts. ISM-1412 has similar requirements for web browsers, with the same rule that the most restrictive guidance takes precedence. Therefore, these controls can be considered interchangeable for compliance purposes.
This control is broader than ISM-1246.
ISM-1246 requires server applications to be hardened using ASD and vendor hardening guidance, applying the most restrictive requirement where guidance conflicts. E8-AH-ML2.1 applies the same hardening approach but focuses on web browsers. Where browser components or embedded browser engines are present on servers (e.g. server management consoles or published apps), E8-AH-ML2.1 is a subset of the broader hardening requirement in ISM-1246.
This control is broader than ISM-1485.
ISM-1485 requires one specific hardening setting: preventing browsers from processing web advertisements from the internet. E8-AH-ML2.1 requires broader browser hardening using ASD and vendor guidance, covering multiple configuration restrictions and security features beyond ad handling. Implementing ISM-1485 would typically contribute to meeting E8-AH-ML2.1, but it would not be sufficient on its own because E8-AH-ML2.1 has wider scope.
This control is broader than ISM-1486.
ISM-1486 requires that web browsers do not process Java from the internet. E8-AH-ML2.1 is broader because it requires hardening web browsers using ASD and vendor guidance across many settings and features, which would typically include disabling/blocking Java where applicable. ISM-1486 is a single, specific hardening requirement within the wider browser-hardening baseline described by E8-AH-ML2.1.
This control is broader than ISM-1858.
ISM-1858 mandates hardening of IT equipment using ASD and vendor guidance, taking the most restrictive position when guidance conflicts. E8-AH-ML2.1 applies this hardening approach to web browsers specifically, which are part of an organisation's IT environment. The candidate is narrower in scope because it focuses on one software category rather than all IT equipment.
This control partially overlaps ISM-1235.
E8-AH-ML2.1 mandates the hardening of web browsers, applying the most restrictive settings available. Similarly, ISM-1235 mandates that web browser extensions and plug-ins be restricted to an organisationally approved set. While ISM-1235 is narrower in scope (focusing on extensions), it overlaps with E8-AH-ML2.1 since browser add-ons are an important aspect of overall browser hardening.
- ISM-1470Disable unneeded accounts, components, services and application functionalityPartially overlaps
This control partially overlaps ISM-1470.
E8-AH-ML2.1 focusses on hardening web browsers using the most restrictive guidance. In comparison, ISM-1470 mandates that unnecessary components, services, and functionality must be disabled or removed. This control specifically aims to reduce attack surfaces, which E8-AH-ML2.1 also accomplishes by setting comprehensive hardening baselines.
This control supports ISM-1585.
ISM-1585 requires that web browser security settings cannot be changed by users. E8-AH-ML2.1 requires hardening web browsers using ASD and vendor guidance, which relies on those hardened settings remaining enforced rather than user-altered. ISM-1585 therefore supports E8-AH-ML2.1 by ensuring the hardened configuration cannot be weakened by end users.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires defining approved configuration baselines informed by vendor and industry hardening guidance; E8-AH-ML2.1 overlaps for web browsers but goes beyond defining a baseline, requiring browsers to be hardened using ASD and vendor hardening guidance, the most restrictive taking precedence in conflicts.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML2.1 applies this to web browsers, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.