ASD ISM 1582 Annual validation of application control rulesets
What it says
Application control rulesets are validated at least annually.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck and approve application control rules once a year to ensure they are effective.
Application control rules are like the doormen for your computer systems. Checking these rules every year is important because if the wrong programs get in, your data could be at risk, which might lead to financial loss or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Neglected application rules can allow harmful software to run, exposing the organisation to data breaches or operational downtime.
How to implement
The IT manager should schedule an annual review of application control rulesets.
This involves setting a date each year to go over the list of approved applications and make sure it's up to date.
IT staff should create a list of all current applications running on the system.
They can do this by checking software installation logs and comparing them with the approved list.
System owners should work with IT staff to identify any applications that are no longer needed.
They can use these findings to remove unnecessary or unauthorised applications from systems.
Managers should involve users in the process to confirm that only required applications are installed.
This can be done by sending a short survey asking about application usage.
The IT department should document any changes to application controls and store these for future audits.
This includes noting why applications were removed or added and who made these decisions.
Keep it running
Ensure application reviews are completed annually and are a collaborative effort. Keep a clear record of any changes for quick reference during audits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the list of current approved applications: Check if there's a formal, updated document listing all allowed software.
Look at
recent updates and approvals.
Good evidence
a regularly updated list with dates and approvals.
- Check 2 of 5What an auditor asks for
Look at
records of any additions or removals from the list. Check for authorisation signatures and justifications.
Good evidence
a clear log showing who approved changes and why.
- Check 3 of 5What an auditor asks for
Ask for
to see the annual review meeting records.
Look at
meeting notes or minutes from these sessions. Verify discussions about the necessity and use of applications.
Good evidence
notes detailing decisions and attendance.
- Check 4 of 5What an auditor asks for
Look at
input from staff about applications used daily.
Good evidence
documented user confirmations or concerns about application usage.
- Check 5 of 5What an auditor asks for
Ask for
a demonstration of the application removal process: Watch how unused or misaligned applications are identified and removed.
Look at
a smooth, clear process.
Good evidence
demonstration shows effective removal without business disruption.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.4, Annual validation of application control rulesets, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AC-ML2.4.
ISM-1582 requires application control rulesets to be validated on an annual or more frequent basis. E8-AC-ML2.4 states the same requirement for annual (or more frequent) validation of application control rulesets. The scope and intent align directly, with both focused on routine review to keep allow/deny rules current.
This control is broader than E8-RM-ML3.6.
E8-RM-ML3.6 requires an annual validation of Microsoft Office's trusted publishers list to ensure only approved macro signers remain trusted. ISM-1582 requires validation of application control rulesets annually or more frequently, which is a broader governance activity covering multiple rule types and applications. E8-RM-ML3.6 is a specific instance of the broader 'validate rulesets' concept applied to Office trusted publishers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.