ASD ISM 1235 Restrict user application extensions
What it says
Extensions for user applications are restricted to an organisation-approved set.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLimit application extensions to those approved by the organisation.
This security measure ensures that employees can only install app extensions that your organisation has approved. This is important because unauthorised extensions can create security vulnerabilities, allowing viruses or hackers access to your systems.
Free. Save your status, tasks and notes.
Why it matters
Without this control, harmful software could sneak in through unapproved extensions, risking data breaches or system downtime.
How to implement
IT team should create a list of approved extensions: Start by gathering input from department heads to understand what extensions are necessary for their teams.
Regularly update this list to meet changing needs.
System administrators should configure application settings: Adjust settings in your software management tools to block all extensions except the ones on the approved list.
Use guides from your software vendors for specific steps.
Managers should communicate policies to staff: Explain the importance of the policy and provide training on how to request new extensions.
Ensure staff understand the security risks associated with unauthorised extensions.
Security officers should monitor logs for unauthorised extensions: Regularly review reports from software tools that track installed extensions.
Look for any installation attempts of non-approved extensions and take corrective actions.
Procurement staff should review and approve new extensions: Employees can request new extensions by submitting a form that includes justification.
Ensure all new extension requests are reviewed for security impact before approval.
Keep it running
Regular updates to the approved extensions list and routine monitoring help ensure compliance and security integrity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the approved extensions list: Request the current list that outlines all extensions approved for use.
Look at
date stamps and revision history.
Good evidence
A complete, up-to-date list reviewed regularly.
- Check 2 of 5What an auditor asks for
Ask for
to see application configuration settings: Request documentation of how extensions are restricted.
Look at
settings that prevent installation of non-approved extensions.
Good evidence
Settings that block all non-approved extensions.
- Check 3 of 5What an auditor asks for
Ask for
communication records about the policy: Request materials or announcements sent to employees about extension restrictions.
Look at
clear instructions and rationale provided to staff.
Good evidence
Well-documented guidance and training evidence.
- Check 4 of 5What an auditor asks for
Ask for
monitoring logs: Request records of monitoring activities related to extension installations.
Look at
evidence of regular checks and responses to unauthorised activity.
Good evidence
Logs showing proactive monitoring and incident management.
- Check 5 of 5What an auditor asks for
Ask for
extension request forms: Review forms submitted by employees for new extensions.
Look at
justifications and approval signatures.
Good evidence
Forms with thorough justifications and a clear approval process.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.6, Office productivity suites are hardened using ASD and vendor guidance, which this control partially meets.
ASD Essential Eight: 5 mappings
This control partially meets E8-AH-ML2.6.
E8-AH-ML2.6 requires hardening office productivity suites using ASD and vendor hardening guidance to reduce exposure to common attack techniques. ISM-1235 specifically requires restricting add-ons, extensions and plug-ins for office productivity suites to an organisation-approved set, which is a common and important part of suite hardening that would be implemented to satisfy E8-AH-ML2.6. E8-AH-ML2.6 is broader because it covers many hardening settings beyond add-on control (for example macro, trust centre, and security feature configurations).
This control partially overlaps E8-AC-ML1.1.
E8-AC-ML1.1 requires application control on workstations to ensure only approved software can run. ISM-1235 overlaps by applying the same allow-listing concept to add-ons, extensions and plug-ins within common workstation applications (browsers, office suites, email clients and PDF applications). ISM-1235 is more specific to in-application extensibility controls, whereas E8-AC-ML1.1 is typically focused on controlling application/script execution at the endpoint level.
This control partially overlaps E8-AC-ML1.3.
E8-AC-ML1.3 requires preventing unapproved execution by allowing only an organisation-approved set of applications and scripts to run. ISM-1235 restricts unapproved code in add-ons, extensions, and plug-ins within common applications.
This control partially overlaps E8-AH-ML1.4.
E8-AH-ML1.4 requires that web browser security settings cannot be changed by users. ISM-1235 restricts browser (and other application) add-ons/extensions to an organisation-approved set, which is a specific browser-hardening control that often relies on preventing users from changing extension settings or installing new extensions. ISM-1235 is narrower and focused on extension governance, while E8-AH-ML1.4 covers all browser security settings, not just add-ons.
This control partially overlaps E8-AH-ML2.1.
E8-AH-ML2.1 mandates the hardening of web browsers, applying the most restrictive settings available. Similarly, ISM-1235 mandates that web browser extensions and plug-ins be restricted to an organisationally approved set. While ISM-1235 is narrower in scope (focusing on extensions), it overlaps with E8-AH-ML2.1 since browser add-ons are an important aspect of overall browser hardening.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.