ISM-1582 policy ASD Information Security Manual (ISM)

Routine Validation of Application Control Rulesets

Check and update app control rules at least yearly to maintain security.

Proactive ML2 ML3 NC OS P ASD Information Security ManualGuidelines for system hardening application security

record_voice_over

Plain language

This control is about routinely checking and updating the rules that determine which applications can run on your organisation's computers. It's important because if these rules get outdated, it might let dangerous software slip through, putting your business at risk of cyber attacks.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Proactive

Classifications

NC, OS, P, S, TS

ISM last updated

Aug 2021

Control Stack last updated

19 Mar 2026

E8 maturity levels

ML2, ML3

Guideline

Guidelines for system hardening

Section

Operating system hardening

Topic

Application Control

Official control statement

Application control rulesets are validated on an annual or more frequent basis.

policy ASD Information Security Manual (ISM) ISM-1582

priority_high

Why it matters

Outdated application control rules can allow unapproved or malicious executables to run, increasing the risk of compromise and disruption.

settings

Operational notes

Validate application control rulesets at least annually and after major changes; remove stale allow rules, confirm blocks still work, and record results and exceptions.

02 - Implement

build

Implementation tips

IT team should schedule an annual review of application control rules. Create a calendar reminder at the beginning of the year to ensure this task doesn’t get missed.
System owners should work with the IT team to identify which applications are critical and must be allowed. Hold a meeting with key team members to list all necessary software.
Managers should communicate with their teams to collect feedback on any application usage issues. Send out a simple survey to understand what applications are needed or problematic.
The IT team should test changes to the rules in a controlled environment before applying them organisation-wide. Set up a test computer or virtual machine to try out the new settings.
Finally, IT staff must update the documentation to reflect any changes made to the application control rules. Use clear language and list each rule change along with reasons.

03 - Audit

fact_check

Audit / evidence tips

AskThe application control review schedule: See the date and frequency of planned reviews GoodShows documented yearly or more frequent reviews
AskMeeting records from application control discussions: Check minutes or notes for evidence of system owner involvement GoodShows engagement from key personnel in updated decisions
AskSurvey responses or feedback collection documentation: Check for details indicating team feedback on application needs GoodDisplays comprehensive input from various users
AskTo see a testing protocol for rule changes GoodIncludes successful test completion and modifications based on results
AskDocumentation on updated rules: Ensure the list is current and clearly written GoodIncludes an accessible, detailed, and current document

04 - Mappings

link

Cross-framework mappings

How ISM-1582 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

E8

Control	Notes	Details
layers Partially meets (1) expand_less
E8-RM-ML3.6	E8-RM-ML3.6 requires an annual validation of Microsoft Office’s trusted publishers list to ensure only approved macro signers remain trusted
link Related (1) expand_less
E8-AC-ML2.4	ISM-1582 requires application control rulesets to be validated on an annual or more frequent basis

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.