Essential Eight AH-ML3.3 PowerShell is configured to use Constrained Language Mode
What it says
PowerShell is configured to use Constrained Language Mode.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLimit PowerShell's capabilities to reduce security risks.
Configuring PowerShell to use Constrained Language Mode limits what PowerShell can do on a computer. This is important because it helps prevent malicious scripts from running that could steal your information or damage your system. Imagine PowerShell as a versatile tool that can perform many tasks, and putting it in Constrained Language Mode means it's only allowed to perform essential, safe tasks.
Free. Save your status, tasks and notes.
Why it matters
Without Constrained Language Mode, attackers can abuse PowerShell to run advanced scripts and .NET methods, leading to privilege escalation, data theft and system compromise.
How to implement
IT team should assess existing PowerShell scripts to identify those that absolutely need to run using Full Language Mode.
This helps in deciding where Constrained Language Mode can be enforced.
System administrator should configure PowerShell to enable Constrained Language Mode.
This can be done by setting system environment variables appropriately or by using group policy settings.
Security officer needs to communicate to staff that legitimate technical tasks requiring PowerShell will not be hindered on regular business systems because essential commands remain operational.
IT team should regularly review and update script policies to make sure that any exceptions to Constrained Language Mode are still justified and that security is not being compromised.
Keep it running
Periodically confirm Constrained Language Mode is enforced (e.g., $ExecutionContext.SessionState.LanguageMode) and that policy/AppLocker/WDAC settings still apply after updates.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Have you configured PowerShell to operate in Constrained Language Mode across the organisation's computers?
Look at
Examine the group policy settings or system environment variables to verify that PowerShell's language mode is set to 'Constrained'.
Good evidence
The settings should clearly indicate that PowerShell is running in Constrained Language Mode, visible through group policy management or confirmed by a system report.
- Check 2 of 2What an auditor asks for
Ask for
Has there been any approval process for exceptions to the Constrained Language Mode?
Look at
Review documentation of any approved exceptions along with reasons for deviations from Constrained Language Mode.
Good evidence
There should be documented approvals signed by a security officer with a clear justification for any exceptions.
Mappings
Closest match in ASD Information Security Manual: ISM-1622, Ensure PowerShell uses Constrained Language Mode, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
E8-AH-ML3.3 requires a specific security configuration: setting PowerShell to Constrained Language Mode to reduce exploitation of scripting features. Annex A 8.9 requires organisations to establish, document, implement, monitor and review security configurations across hardware, software, services and networks, which would include PowerShell configuration baselines. The ISO control is broader governance and lifecycle management, while E8-AH-ML3.3 is one concrete configuration requirement within that broader configuration management discipline.
This control partially overlaps A.8.18.
Annex A 8.18 requires restricting and tightly controlling utility programs that can override system and application controls to prevent unauthorised or unsafe changes. E8-AH-ML3.3 relates because configuring PowerShell to use Constrained Language Mode limits a powerful scripting utility that can be used to bypass controls or perform unauthorised system changes. However, Annex A 8.18 applies to utility programs generally (not just PowerShell) and is centred on restricting use, while E8-AH-ML3.3 is a specific hardening configuration for one tool.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1622.
ISM-1622 requires PowerShell to be configured to use Constrained Language Mode to limit script capability and reduce abuse. E8-AH-ML3.3 states the same requirement with the same technical outcome (PowerShell constrained to CLM). Implementing either control would substantially satisfy the other as they target the same configuration setting and risk.
This control partially meets ISM-0380.
E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, restricting available functionality to reduce attack techniques that rely on PowerShell. This relates to ISM-0380 because constraining PowerShell is a form of reducing unnecessary operating system functionality and services available to users and processes. ISM-0380 is broader and covers disabling or removing a wide range of unneeded OS accounts, components and services, whereas E8-AH-ML3.3 targets one specific scripting control.
This control partially meets ISM-1409.
E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode to reduce the risk of malicious script execution. This aligns with ISM-1409 because Constrained Language Mode is an operating system/application hardening setting typically implemented via Microsoft hardening guidance and security baselines. ISM-1409 is broader, requiring comprehensive operating system hardening across many controls beyond PowerShell configuration.
This control partially meets ISM-1798.
ISM-1798 requires secure configuration guidance to be produced and shared with software consumers. E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, which is a specific hardening configuration that would typically be described in a hardening guide. The candidate mandates an endpoint configuration outcome, while ISM-1798 is about ensuring the guidance exists (across software) rather than enforcing this particular PowerShell setting.
This control partially meets ISM-1858.
ISM-1858 requires hardening of IT equipment using ASD and vendor guidance, adopting the most restrictive configuration when guidance differs. E8-AH-ML3.3 requires configuring PowerShell to use Constrained Language Mode, which is a targeted hardening configuration reducing scripting abuse on endpoints. The candidate is a narrow, specific hardening requirement that fits within the broader hardening obligation of ISM-1858.
This control partially overlaps ISM-1246.
ISM-1246 ensures server applications are hardened using ASD/vendor guidance, following the most restrictive precedence. E8-AH-ML3.3 configures PowerShell to use Constrained Language Mode, a hardening control potentially required by server hardening baselines. Though E8-AH-ML3.3 is limited to PowerShell, ISM-1246 applies comprehensively to all server applications.
This control partially overlaps ISM-1491.
ISM-1491 requires organisations to prevent unprivileged users from running PowerShell (and other script execution engines) at all. E8-AH-ML3.3 requires PowerShell to use Constrained Language Mode, which limits what PowerShell can do rather than blocking it outright. The controls overlap in addressing PowerShell abuse, but ISM-1491 is stricter (deny execution) while E8-AH-ML3.3 is a hardening constraint that may still permit some PowerShell use.
This control depends on ISM-1621.
ISM-1621 requires organisations to disable or remove Windows PowerShell 2.0 so PowerShell cannot fall back to a legacy engine with reduced logging and security capabilities. E8-AH-ML3.3 configures PowerShell to use Constrained Language Mode, which reduces script and API abuse in the remaining PowerShell environment. Disabling PowerShell 2.0 (ISM-1621) strengthens the effectiveness of Constrained Language Mode by preventing downgrade paths, but it is not the same control objective.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, a PowerShell restriction such a baseline would set.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, one specific configuration a deployed baseline would apply.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.