ASD ISM 0843 Ensure workstation security with application control
What it says
Application control is implemented on workstations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApplication control is used to secure workstations by managing which programs can run.
Application control means keeping a tight lid on which software programs are allowed to run on your office computers. This matters because if unapproved or malicious software runs, it can lead to data loss, privacy breaches, or even bring your business operations to a halt.
Free. Save your status, tasks and notes.
Why it matters
Without application control on workstations, unauthorised or malicious software can run, enabling malware, data theft and service disruption.
How to implement
IT team should develop a list of approved applications: Create and maintain an up-to-date list of software that is permitted to run on workstations.
Engage with team leaders to identify necessary software and consider officially receiving confirmations from department heads for accuracy.
System administrators should deploy application control software: Use specific security tools or settings to ensure only the approved applications from the list can run.
Follow vendor guides or seek external expertise for the setting up to cover all user devices properly.
Managers should conduct regular software audits: Periodically review the software installed on workstations compared to the approved list to ensure compliance.
This can be done quarterly by scheduling a meeting to go over installed applications and updating the list if needed.
Procurement officers should involve IT in software purchases: Ensure any new software purchases are reviewed and approved by the IT team to prevent unauthorised applications from being used.
Establish a process where all purchasing requests need IT approval before proceeding.
Training coordinators should organise staff awareness sessions: Educate staff about the importance of using only approved software and how to request new software if needed.
Run annual sessions or include this information in onboarding training, providing clear instructions for requesting new applications.
Keep it running
Maintain workstation application control by reviewing allow/deny rules and updating authorised application lists after patches, installs and business changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of approved applications: Request the official document that details all software allowed for use.
Look at
The software names and versions for completeness and currency.
Good evidence
List is up-to-date, aligns with current company needs, and is reviewed regularly.
- Check 2 of 5What an auditor asks for
Ask for
The application control policy: Request the document that outlines how application control is managed within the organisation.
Look at
Clear guidelines on application approval processes. A comprehensive policy includes steps for approving new software and the roles responsible for checks.
- Check 3 of 5What an auditor asks for
Ask for
Records of software audits: Request reports or logs from the most recent software audits.
Look at
Evidence of regular checks against the approved list.
Good evidence
Record will show frequent audits and any discrepancies noted and actions taken.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of staff training sessions: Request attendance records or materials used for recent training sessions on application control.
Look at
Dates, attendee lists, and session contents. Successful records show all staff attended and the sessions covered how to handle software requests.
- Check 5 of 5What an auditor asks for
Ask for
Procurement records involving IT sign-off: Request purchase orders or approval forms showing IT involvement in software acquisition decisions.
Look at
Signatures or approvals from IT staff. A robust process has consistent IT sign-off before any software purchase.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML1.1, Application control is implemented on workstations., which asks for the same thing.
ASD Essential Eight: 8 mappings
This control is equivalent to E8-AC-ML1.1.
E8-AC-ML1.1 requires organisations to implement application control on workstations so only approved software can run. ISM-0843 states the same requirement-application control is implemented on workstations. Both controls align in scope (workstations) and intent (restrict execution to authorised applications) with no material difference in depth stated.
This control is broader than E8-AC-ML1.2.
E8-AC-ML1.2 requires organisations to apply application control specifically to user profiles and temporary folders used by operating systems, web browsers and email clients. ISM-0843 is broader, requiring application control to be implemented on workstations generally, which would typically include (but is not limited to) controls for user profile and temp locations. E8-AC-ML1.2 is a specific coverage expectation within the more general workstation application control requirement in ISM-0843.
This control is broader than E8-AC-ML2.2.
E8-AC-ML2.2 requires application control to be applied across system locations, explicitly excluding user profiles and temporary folders used by operating systems, web browsers and email clients. ISM-0843 requires application control to be implemented on workstations, which is a platform-scoped requirement that would typically include applying controls across workstation execution paths. ISM-0843 does not express the specific location-based scoping/exclusions that E8-AC-ML2.2 mandates.
This control is broader than E8-AC-ML2.3.
E8-AC-ML2.3 requires implementing Microsoft's recommended application blocklist as part of controlling what can run in the environment. ISM-0843 requires application control to be implemented on workstations, which is a broader foundational control that can include (but is not limited to) applying Microsoft's blocklist. E8-AC-ML2.3 is a specific implementation detail within a wider workstation application control capability described by ISM-0843.
This control is broader than E8-AH-ML2.2.
E8-AH-ML2.2 requires a specific application control hardening rule: blocking Microsoft Office from creating child processes. ISM-0843 requires application control to be implemented on workstations, providing the broader control framework and enforcement mechanism that can include rules like Office child-process blocking. ISM-0843 covers a wider set of executables and execution conditions, whereas E8-AH-ML2.2 is a targeted Office restriction within that broader application control capability.
This control partially overlaps E8-AC-ML1.3.
ISM-0843 requires application control to be implemented on workstations. E8-AC-ML1.3 extends that concept by specifying that application control must restrict many content types (executables, libraries, scripts, installers, etc.) to an organisation-approved set. ISM-0843 establishes the foundational control, while E8-AC-ML1.3 clarifies a more detailed and comprehensive application control enforcement expectation.
This control supports E8-AC-ML2.4.
ISM-0843 requires application control to be implemented on workstations. E8-AC-ML2.4 relates by requiring periodic validation of application control rulesets to ensure they remain accurate and effective over time. ISM-0843 focuses on implementing the control, while E8-AC-ML2.4 focuses on maintaining and assuring that the implementation continues to enforce intended execution restrictions.
This control supports E8-RA-ML3.2.
E8-RA-ML3.2 requires administrative activities to be performed only from Secure Admin Workstations (SAWs) to reduce exposure to malware and user browsing risks. ISM-0843 requires application control on workstations, which is a common foundational hardening measure typically necessary to qualify a workstation as a SAW. ISM-0843 can apply to all workstations, whereas E8-RA-ML3.2 is specifically about restricting privileged work to the dedicated secure endpoint.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.