ASD ISM 1544 Implement Microsoft's application blocklist
What it says
Microsoft's recommended application blocklist is implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must use Microsoft's blocklist to stop unauthorised applications from running.
If your organisation doesn't use Microsoft's blocklist, unauthorised applications might run on your computers. These rogue apps could mess with your sensitive data or even let hackers into your system. By using the blocklist, you're essentially putting guardrails up, stopping anything you haven't explicitly approved from causing havoc.
Free. Save your status, tasks and notes.
Why it matters
Without Microsoft's recommended application blocklist, known malicious or unwanted apps may run on endpoints, increasing malware execution and unauthorised access risk.
How to implement
Organisation's IT Manager should communicate with Microsoft's technical support to understand the latest blocklist updates.
How: Subscribe to updates and regularly coordinate with Microsoft to ensure the blocklist is current and applicable to your systems.
The IT team should configure company computers to apply Microsoft's blocklist using available tools like Windows Defender Application Control.
How: Access the control settings on each device or manage them centrally through your network systems and enforce the blocklist.
Procurement staff should ensure any new software purchases are verified against the Microsoft blocklist.
How: Before buying or installing any new application, check it against the blocklist to ensure it's not prohibited.
Managers should educate employees on the importance of only using allowed software.
How: Conduct mandatory training sessions explaining why unapproved applications can pose risks and how the blocklist helps keep everyone safe.
The IT team should perform regular checks to ensure the blocklist is active on all devices.
How: Use audit tools or management software to verify that every device has the blocklist enforced, and manually check settings on a sample of devices.
Keep it running
Regularly update Microsoft's recommended blocklist and validate WDAC/AppLocker rules so newly identified malicious apps are blocked across all managed endpoints.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A report of all software installed on company computers in the past month.
Look at
Software names and compare them against the Microsoft blocklist.
Good evidence
A list showing only allowed applications and confirmation that no blocklisted apps are installed.
- Check 2 of 5What an auditor asks for
Look at
The date and time when the blocklist was last updated.
Good evidence
Logs indicating regular updates synchronised with the latest Microsoft blocklist releases.
- Check 3 of 5What an auditor asks for
Ask for
To see training materials used to educate staff about authorised applications.
Look at
Clear guidance on what is allowed and the risks of unauthorised software.
Good evidence
Comprehensive guides and evidence of participation by all employees.
- Check 4 of 5What an auditor asks for
Look at
A record of checks performed and outcomes noted.
Good evidence
A report showing successful verification that the blocklist is active and enforced across devices.
- Check 5 of 5What an auditor asks for
Ask for
A checklist or protocol used by procurement before purchasing software.
Look at
Cross-references to the blocklist to ensure compliance.
Good evidence
Documented steps where checking against the Microsoft blocklist is a mandatory clause before any software agreement.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.3, Microsoft's recommended application blocklist is implemented, which asks for the same thing.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-AC-ML2.3.
E8-AC-ML2.3 requires organisations to implement Microsoft's recommended application blocklist to prevent execution of known risky/abusable applications. ISM-1544 states the same requirement: that Microsoft's recommended application blocklist is implemented. The scope and intent align closely, with both focused on using Microsoft's curated blocklist as an application control hardening measure.
This control depends on E8-AC-ML1.1.
E8-AC-ML1.1 requires application control on workstations so that only approved applications can run. ISM-1544 supports this by providing a concrete control input (Microsoft's recommended application blocklist) that can be used to strengthen workstation application control policy and enforcement. ISM-1544 is narrower in that it focuses on one vendor's blocklist rather than the full allow-listing capability implied by E8-AC-ML1.1.
This control depends on E8-AC-ML1.2.
E8-AC-ML1.2 requires application control to cover user profiles and temporary folders to block execution of unapproved software from those locations. ISM-1544 supports this by adopting Microsoft's recommended application blocklist, which strengthens what is denied even if malicious binaries are written into user or temp directories. ISM-1544 is focused on deny-list content, whereas E8-AC-ML1.2 is focused on ensuring the high-risk directories are actually enforced by application control.
This control depends on E8-AC-ML2.2.
ISM-1544 requires implementing Microsoft's recommended application blocklist to block known undesirable/unauthorised applications. E8-AC-ML2.2 requires application control to be applied broadly (to all locations other than user profiles and temporary folders), and the Microsoft blocklist can be embedded within those rules to improve blocking effectiveness. E8-AC-ML2.2 is primarily about ruleset coverage by location, while ISM-1544 is about adopting Microsoft's recommended block content.
This control depends on E8-AC-ML3.1.
ISM-1544 requires implementation of Microsoft's recommended application blocklist to stop unauthorised applications from executing. E8-AC-ML3.1 requires application control on non-internet-facing servers, and Microsoft's blocklist can be used to harden the deny component of those server application control policies. E8-AC-ML3.1 is about where application control is applied, while ISM-1544 is about which Microsoft-provided block rules are implemented.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.