Essential Eight AH-ML2.8 Block PDF software from creating child processes
What it says
PDF software is blocked from creating child processes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent PDF programs from running other programs to improve security.
Blocking PDF programs from running other programs helps prevent cybercriminals from using them to install malicious software on your computer. Without this control, opening an innocent-looking PDF file could unwittingly allow attackers to sneak harmful programs into your system.
Free. Save your status, tasks and notes.
Why it matters
If PDF apps can spawn child processes, a malicious PDF may execute malware, enabling code execution and data compromise.
How to implement
IT Team should configure PDF software settings to block it from creating child processes.
This can usually be done through the software's advanced security settings options.
System Administrator should apply group policies that restrict PDF applications from executing other programs.
Use the Group Policy Editor to configure these settings across the network.
Security Officer should ensure all staff use approved PDF readers that adhere to the organisation's security policies.
Deploy chosen software via a software management tool to ensure consistency.
IT Support should regularly update PDF software to the latest version to ensure all security patches are applied.
Enable automatic updates where possible.
IT Team should conduct regular checks to verify that the policy preventing PDF software from creating child processes is still in place and active.
Keep it running
Enforce OS policy (e.g., ASR/WDAC/AppLocker) to block PDF readers from launching child processes; audit events and exceptions regularly.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Have the PDF applications been restricted from creating child processes?
Look at
Review the group policy settings related to PDF software.
Good evidence
The group policy clearly shows settings preventing PDF applications from creating child processes, confirmed by policy export or screenshots.
- Check 2 of 2What an auditor asks for
Ask for
Are there regular audits ensuring compliance with this policy?
Look at
Check the records of periodic reviews and audits on PDF software configurations.
Good evidence
There are documented audit logs with consistent findings, confirming adherence to the policy.
Mappings
Closest match in ASD Information Security Manual: ISM-1670, Prevent PDF applications from creating child processes, which asks for the same thing.
ASD Information Security Manual: 1 mapping
This control is equivalent to ISM-1670.
E8-AH-ML2.8 requires that PDF software is blocked from creating child processes to prevent PDFs launching other executables. ISM-1670 states the same requirement: PDF applications are blocked from creating child processes. The scope and intent align directly, so implementing one would largely satisfy the other.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML2.8 requires PDF software to be blocked from creating child processes, a PDF software setting such a baseline would include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.