ASD ISM 1392 Restrict file modifications via path rules
What it says
When implementing application control using path rules, only approved users can modify approved files and write to approved folders.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly certain users can change files and folders as allowed by system rules.
This control is about making sure that only the right people can change important files and folders on your computer system. It matters because if everyone could make changes, it could lead to accidental or malicious damage, like removing critical files or installing harmful programs that could disrupt your business.
Free. Save your status, tasks and notes.
Why it matters
If path rules allow unauthorised changes to approved files or folders, attackers can tamper with trusted apps, causing compromise or outages.
How to implement
IT team should define which files and folders are critical or sensitive.
They can do this by listing all essential files and directories that impact business operations or hold sensitive information.
The manager should decide which staff require permission to modify these critical files.
This involves assessing job roles and responsibilities to determine who truly needs access.
The system administrator should set up path rules on the operating system to enforce these permissions.
They can do this by configuring the system settings so that only approved users can make changes to specified files and folders.
The HR team should ensure that permission settings are regularly reviewed and updated, especially when staff roles change.
This means checking who currently has access to sensitive files and modifying permissions as needed during role changes or staff turnover.
The IT team should provide training to staff on why these rules and restrictions are in place.
This can be done through regular information sessions explaining the importance of protecting digital assets and preventing unauthorised access.
Keep it running
Review and test path rules regularly so only approved users can write to approved folders and modify approved files; monitor and audit rule changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of approved files and folders with restricted access.
Look at
The details to confirm the list is complete and up-to-date.
Good evidence
Includes a dated document with file paths and the names of those with access permissions.
- Check 2 of 5What an auditor asks for
Ask for
The access permissions report from the system.
Look at
The configurations to see if path rules are correctly implemented.
Good evidence
Shows clear rules set for specific files and users as intended.
- Check 3 of 5What an auditor asks for
Ask for
To see the HR process for updating user access permissions.
Look at
When and how permissions are reviewed.
Good evidence
Includes documented procedures and logs showing regular updates and checks.
- Check 4 of 5What an auditor asks for
Ask for
Records of training sessions on file access restrictions.
Look at
Attendance records and materials covered.
Good evidence
Includes a schedule of training sessions and outlined topics discussed with evidence of participant attendance.
- Check 5 of 5What an auditor asks for
Ask for
A log of access attempts to sensitive files.
Look at
The log to ensure failed attempts are effectively monitored.
Good evidence
Shows proactive monitoring with irregular activities flagged for review and action.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-1392 requires a concrete access restriction outcome: only approved users can modify approved files and write to approved folders when path-based application control is used. Annex A 5.15 requires establishing and implementing access control rules (physical and logical) based on business and security requirements. ISM-1392 is one specific logical access rule implementation (file system write/modify restrictions) within the broader policy/procedure requirements of Annex A 5.15.
This control partially meets A.5.18.
ISM-1392 requires that when application control uses path rules, only approved users can modify approved files and write to approved folders. Annex A 5.18 requires organisations to provision, review, modify and remove access rights to information assets in line with access control policy. ISM-1392 is a specific technical enforcement of write/modify permissions in defined paths, whereas Annex A 5.18 is broader lifecycle governance across all access rights.
This control partially meets A.8.3.
ISM-1392 requires enforcing that only approved users can modify approved files and write to approved folders under application control path rules. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy. ISM-1392 is a specific access restriction for write/modify actions in defined paths, whereas Annex A 8.3 is broader and covers access restrictions for all asset types and access modes.
This control supports A.8.2.
ISM-1392 requires that only approved users can modify approved files and write to approved folders when path rules are used for application control. Annex A 8.2 focuses on restricting and managing privileged access rights allocation and use. ISM-1392 supports Annex A 8.2 by reducing where privileged write/modify rights are effective, but Annex A 8.2 also covers broader privileged access governance beyond file/folder path restrictions.
ASD Essential Eight: 6 mappings
This control partially overlaps E8-RM-ML3.3.
ISM-1392 requires restricting who can modify files/folders covered by application control path rules. E8-RM-ML3.3 similarly restricts who can write to and modify content, but it is scoped specifically to Microsoft Office macro Trusted Locations and to privileged users who perform macro checking. ISM-1392 is broader across approved files/folders under path rules, while E8-RM-ML3.3 is narrower to a particular application feature and threat scenario.
This control supports E8-AC-ML2.1.
E8-AC-ML2.1 requires application control on internet-facing servers, often relying on allow rules to constrain what can run. ISM-1392 is a prerequisite safeguard when path rules are used, ensuring only approved users can modify approved files and write to approved folders so attackers cannot bypass application control by dropping or altering binaries in allowed paths. E8-AC-ML2.1 can be implemented without path rules, but where path rules are used this control becomes foundational.
This control supports E8-AC-ML2.2.
E8-AC-ML2.2 requires broad application control with folder exclusions. ISM-1392 complements by ensuring only approved users can modify files, reducing risks like path-rule bypass.
This control depends on E8-AC-ML1.2.
E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders, which are frequently writable and targeted for execution. ISM-1392 supports this by specifying that, where path rules are used, only approved users can modify approved files and write to approved folders, reducing bypass opportunities in user and temp locations. ISM-1392 is a hardening requirement for path-rule implementations, whereas E8-AC-ML1.2 is the coverage requirement for those risky directories.
This control depends on E8-AC-ML1.3.
E8-AC-ML1.3 requires application control to restrict execution to an organisation-approved set. ISM-1392 adds a requirement to ensure only approved users can modify approved files and write to approved folders, enhancing control integrity and supporting E8-AC-ML1.3.
This control depends on E8-AC-ML3.2.
E8-AC-ML3.2 requires application control to restrict driver execution to an approved set, which is only effective if the allow-list cannot be modified by unauthorised users. ISM-1392 requires that when path rules are used for application control, only approved users can modify approved files and write to approved folders, reducing the risk of swapping or tampering with allow-listed items. This is a prerequisite hardening condition that helps ensure E8-AC-ML3.2 cannot be bypassed via file/folder modification on allow-listed paths.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-07.2Restrict administrative and management tools to approved sets and authorised locationsPartially overlaps
This control partially overlaps IT.PRO-07.2.
IT.PRO-07.2 requires admin and management tooling to be limited to approved software run from authorised, known locations; ISM-1392 requires that, where application control uses path rules, only approved users can modify approved files and write to approved folders, protecting those locations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.