ASD ISM 0955 Implementing application control measures
What it says
Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure applications are controlled using secure hashing, valid certificates, or designated paths.
Application control is about keeping a tight grip on which programs can run on your computers or devices. This matters because letting the wrong programs run-whether accidental or malicious-can lead to data breaches, system crashes, or lost information, putting your business or school at risk.
Free. Save your status, tasks and notes.
Why it matters
Without cryptographic hash, publisher certificate, or path rules, unauthorised software can run, causing compromise, malware infection, breaches, and instability.
How to implement
The IT team should create a list of approved applications by evaluating which programs are necessary for daily operations.
They can do this by consulting department heads and staff to understand their needs and ensuring only verified applications are listed.
System administrators should use secure hashing to verify applications.
This involves using a tool to generate a unique code for each program file and periodically checking that the code hasn't changed, which would indicate the file's been tampered with.
Managers should ensure applications have valid publisher certificates.
Request your software vendors to provide certificates for their products, and keep a record of these to verify the legitimacy of the software being used.
The IT team should set up path rules to control where applications can run from.
They should assess and lock down folders that staff use regularly, ensuring you're only using paths meant for business purposes and not allowing unknown locations.
Managers should run regular training sessions to inform all staff about application control policies.
During these sessions, explain the importance of only installing approved applications and demonstrate what steps to take if an unauthorised application is encountered.
Keep it running
Maintain application control by updating hash, publisher certificate and path rules, and re-validating hashes after application updates to prevent unauthorised execution.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The approved application list: Request the document or database showing which applications are authorised for use.
Look at
Whether it is regularly updated and includes all required applications.
Good evidence
Will include a recent update timestamp and include a signature or initials from the person responsible for maintaining it.
- Check 2 of 5What an auditor asks for
Ask for
Documented proof of secure hashing: Request evidence of hash verification processes, such as logs or screenshots.
Look at
Whether these logs show recent checks and any identified tampering.
Good evidence
Includes entries that are recent with no unresolved discrepancies.
- Check 3 of 5What an auditor asks for
Ask for
Certificate records: Request to see the repository of valid certificates for each program.
Look at
Whether certificates are current and match the installed software.
Good evidence
Would show matching and unexpired certificates with detailed vendor information.
- Check 4 of 5What an auditor asks for
Ask for
Path rules documentation: Request configuration files or guidelines showing designated program paths.
Look at
Whether the documents specify which folders are authorised for running applications.
Good evidence
Is clear documentation that aligns with current system settings and is approved by IT staff.
- Check 5 of 5What an auditor asks for
Ask for
To see staff training records: Request evidence of application control training sessions held for staff.
Look at
Attendance records and training materials used.
Good evidence
Includes dated records of recent training sessions with clear attendance logs.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.2, Block Microsoft Office from creating child processes, which this control covers in full and more.
ASD Essential Eight: 11 mappings
This control is broader than E8-AH-ML2.2.
E8-AH-ML2.2 requires Microsoft Office to be blocked from creating child processes as a specific preventative execution control. ISM-0955 requires application control to be implemented using specific rule types (cryptographic hash, publisher certificate or path rules), which is a broader method/control family that can be used to implement restrictions affecting what runs and how it is allowed to execute. ISM-0955 does not uniquely mandate the Office child-process restriction, but E8-AH-ML2.2 is a particular hardening outcome that can sit within an ISM-0955 application control implementation.
This control partially meets E8-AC-ML1.1.
ISM-0955 requires organisations to implement application control using hash, publisher certificate, or path rules. E8-AC-ML1.1 requires application control on workstations, which is a specific endpoint scope where ISM-0955's rule types can be implemented. E8-AC-ML1.1 is silent on rule construction, while ISM-0955 is specifically about the mechanisms used to define control rules.
This control partially meets E8-AC-ML3.1.
ISM-0955 requires application control to be implemented using cryptographic hash, publisher certificate, or path-based rules. E8-AC-ML3.1 requires application control on non-internet-facing servers, representing a particular environment where ISM-0955's rule types would be used. E8-AC-ML3.1 is about coverage across server classes, whereas ISM-0955 specifies acceptable technical approaches for controlling execution.
This control partially overlaps E8-AC-ML1.2.
ISM-0955 requires organisations to implement application control using hash, publisher certificate, or path rules. E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders, which is a deployment scope decision for the same application control capability. ISM-0955 does not specify where enforcement must occur, while E8-AC-ML1.2 does not specify which rule types must be used.
This control partially overlaps E8-AC-ML2.2.
ISM-0955 requires implementing application control using hash, publisher certificate, or path rules to control what can execute. E8-AC-ML2.2 specifies where application control must be applied by excluding user profiles and temporary folders from enforcement at that maturity level, which affects the scope of application control deployment. ISM-0955 is about rule types and does not define location-based exclusions, while E8-AC-ML2.2 is primarily about coverage boundaries rather than rule mechanics.
This control partially overlaps E8-AC-ML2.4.
ISM-0955 requires application control to be implemented using defined rule types such as cryptographic hash, publisher certificate, or path rules. E8-AC-ML2.4 requires validation of application control rulesets at least annually, which applies to the same rules that ISM-0955 expects to exist. ISM-0955 does not mandate review cadence, while E8-AC-ML2.4 does not prescribe which rule types must be used.
This control partially overlaps E8-AC-ML3.2.
ISM-0955 requires application control to be implemented using cryptographic hash, publisher certificate, or path rules. E8-AC-ML3.2 applies application control concepts specifically to drivers by restricting driver execution to an approved set, which can be implemented using the rule types described in ISM-0955. E8-AC-ML3.2 is narrower to drivers and approval scope, while ISM-0955 is broader across applications and focused on the technical rule constructs.
This control supports E8-AC-ML2.3.
ISM-0955 requires application control to be implemented using hash, publisher certificate, or path rules. E8-AC-ML2.3 requires implementing Microsoft's recommended application blocklist, which is typically operationalised through application control rule constructs such as publisher or hash rules consistent with ISM-0955. The blocklist provides content for rules, while ISM-0955 defines the acceptable technical methods for enforcing those rules.
This control supports E8-AC-ML2.5.
ISM-0955 requires application control to be implemented using specific rule types (hash, publisher certificate, or path rules). E8-AC-ML2.5 requires centrally logging allowed and blocked application control events, which strengthens governance and monitoring of the application control implemented under ISM-0955. Logging does not implement the control mechanism itself, but it provides evidence and detection capability for the outcomes of ISM-0955 enforcement.
This control depends on E8-AC-ML1.3.
E8-AC-ML1.3 requires that only approved applications and scripts can run using application control. ISM-0955 specifies acceptable technical methods for implementing application control, providing implementation detail for E8-AC-ML1.3.
This control depends on E8-AC-ML2.1.
E8-AC-ML2.1 requires application control to be implemented on internet-facing servers. ISM-0955 supports this by specifying recognised implementation methods (cryptographic hash, publisher certificate, or path rules) that can be used to realise application control on those servers. E8-AC-ML2.1 sets the outcome and scope, while ISM-0955 provides acceptable technical mechanisms.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.