ASD ISM 0846 Users cannot disable, bypass or be exempted from application control
What it says
Users cannot disable or bypass application control, and are not exempted from application control, except when using local administrator accounts or break glass accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStandard users must have no way to switch off, get around or be excluded from application control; only local administrator and break glass accounts may be exempt.
Application control only works if it applies to everyone it is meant to cover, all the time. This control says that ordinary users must not be able to turn application control off, must not be able to get around it (for example by running a program from a location or in a way the rules do not check), and must not be quietly excluded from it through an exemption or an "allow everything" rule for their account or group. The statement allows exactly two exceptions: local administrator accounts and break glass accounts. These are the accounts used for planned maintenance or for regaining access in an emergency, and they are the only accounts permitted to operate outside application control. Why it matters: attackers rarely need to defeat application control head-on. They look for the user who was exempted "temporarily" months ago, the workstation where the policy runs in audit-only mode, or the folder that was allowed for convenience. Any of those gaps lets malware or an unauthorised tool run as if application control were not there. Restricting exemptions to a tiny, well-understood set of privileged accounts keeps the protection whole and keeps the number of accounts that can run anything to a minimum.
Free. Save your status, tasks and notes.
Why it matters
If users can disable, bypass or be exempted from application control, the protection becomes optional in practice. A phished user, or malware running under their account, can turn enforcement off or use an exempt account or path to execute untrusted code, leading to compromise, ransomware or data theft on systems that were assumed to be protected. Broad exemptions also undermine any assurance or maturity claim that relies on application control being enforced.
How to implement
The endpoint or platform team configures the application control policy centrally (for example via group policy, MDM or the application control product's management console) in enforce mode for all standard user accounts, and restricts the ability to edit, pause or uninstall the policy to privileged administrative accounts only.
The identity or access management team removes standing local administrator rights from standard user accounts, so that a user cannot use elevated rights to switch off or work around application control.
The security team documents the approved list of local administrator accounts and break glass accounts that are permitted to operate outside application control, and configures the policy so that only those named accounts or groups are excluded.
The security team reviews the application control policy for any user, group or path-based exemptions beyond the approved accounts, removes them, and routes any legitimate software need through the normal application assessment and allow-listing process instead of a user exemption.
The operations team schedules a recurring check (scripted where possible) that confirms enforcement is active on every in-scope endpoint and that the exemption set still matches the approved list, raising a ticket for any drift.
Keep it running
Day to day this control is about keeping the exemption list tiny and the enforcement settings out of user reach.
- Configure application control so it is enforced (not audit-only) for all standard user accounts, and lock the settings so users cannot change them (for example, settings delivered by central policy rather than editable locally).
- Remove local administrator rights from standard users; a user who is a local administrator is effectively exempt, so this control depends on the wider privilege model.
- Maintain a short, documented list of local administrator and break glass accounts that are permitted to operate outside application control. Nothing else, including service desk staff, developers or executives, should appear on it under a normal user account.
- When someone asks for an exemption to run a blocked program, the answer is to assess and approve the program through the normal allow-listing process, not to exempt the person.
- Periodically check that enforcement is still active on endpoints and that no new accounts, groups or paths have been added as exemptions outside the approved set.
- Log and review use of local administrator and break glass accounts, since these are the accounts that can operate without application control.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the current application control policy configuration as applied to standard user accounts.
Look at
Check whether the policy is in enforce mode rather than audit-only for standard users, and whether users have any permission to edit, pause or uninstall it.
Good evidence
The policy is enforced for all standard users and the settings are locked so that only privileged administrative accounts can change them.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the list of accounts, groups or paths that are exempt from application control.
Look at
Compare every exemption against the two permitted categories: local administrator accounts and break glass accounts.
Good evidence
Every exemption maps to a documented local administrator or break glass account, and there are no exemptions for ordinary users, groups or convenience folders.
- Check 3 of 5What an auditor asks for
Ask for
Ask for evidence of the local administrator rights held by standard users on in-scope workstations and servers.
Look at
Look for standard user accounts that are members of local administrator groups, since those users could disable application control themselves.
Good evidence
Standard users do not hold local administrator rights, and any local administrator membership is limited to the approved administrative and break glass accounts.
- Check 4 of 5What an auditor asks for
Ask for
Ask for a demonstration or test result showing a standard user attempting to disable or bypass application control.
Look at
See whether the user can stop the enforcement service, change the policy, or run an unapproved program from an alternative location.
Good evidence
The attempts fail and are logged, and the only accounts shown to be able to change the policy are the approved privileged accounts.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the most recent review of application control enforcement status and exemptions across in-scope endpoints.
Look at
Check that the review covers all endpoints, identifies any drift in enforcement or exemptions, and shows how drift was corrected.
Good evidence
Reviews are performed regularly, any endpoint found not enforcing or any unapproved exemption was remediated, and the exemption list still matches the approved accounts.
Mappings
Closest match in ISO/IEC 27001: A.8.18, Use of privileged utility programs, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.18.
Annex A 8.18 requires that utilities capable of overriding system and application controls are restricted and tightly controlled, which commonly relies on enforcement mechanisms such as application control. ISM-0846 supports this by ensuring users cannot disable, bypass, or be exempted from application control, preserving the effectiveness of restrictions applied to installers and administrative utilities. ISM-0846 does not directly define which utilities are restricted, but it strengthens the control integrity needed for Annex A 8.18 to be reliable on operational systems.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-AC-ML2.2.
E8-AC-ML2.2 requires application control coverage across locations (with defined exclusions for user profiles and temporary folders). ISM-0846 requires that users (except local administrators and break glass accounts) cannot disable, bypass or be exempted from application control, which helps ensure the location-based enforcement in E8-AC-ML2.2 cannot be circumvented by standard users. E8-AC-ML2.2 is about where application control is applied, while ISM-0846 is about preventing user-driven weakening of that control.
This control supports E8-AC-ML1.3.
E8-AC-ML1.3 requires restricting execution to an organisation-approved set through application control. ISM-0846 strengthens this by ensuring normal users cannot disable or bypass application control, preserving enforcement of E8-AC-ML1.3.
This control depends on E8-AC-ML1.1.
E8-AC-ML1.1 requires application control to be implemented on workstations. ISM-0846 supports E8-AC-ML1.1 by mandating that standard users cannot disable, bypass, or be exempted from application control, which preserves the effectiveness and coverage of the control. ISM-0846 is governance/enforcement hardening around the control, while E8-AC-ML1.1 is the primary requirement to implement it.
This control depends on E8-AC-ML1.2.
E8-AC-ML1.2 requires enforcement of application control within user profiles and temporary folders to prevent users and malware running code from those writable locations. ISM-0846 supports this by ensuring standard users cannot disable, bypass or be exempted from application control, which is necessary to keep enforcement effective in user and temp paths. ISM-0846 focuses on preventing circumvention by users/accounts, while E8-AC-ML1.2 focuses on ensuring the risky directory locations are included in enforcement scope.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.2Restrict administrative and management tools to approved sets and authorised locationsPartially overlaps
This control partially overlaps IT.PRO-07.2.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; ISM-0846 stops users disabling, bypassing or being exempted from application control, except via local administrator or break glass accounts, keeping such restrictions in force.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.