ASD ISM 1656 Implement application control on secure servers
What it says
Application control is implemented on non-internet-facing servers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure servers not connected to the internet have application control for security.
This control ensures that applications on servers not connected to the internet are managed carefully to prevent unauthorised programs from running, which could lead to data breaches or operational disruptions. This is important because if these unmanaged applications run unchecked, they could introduce malware or cause other security issues that are hard to detect and manage since the servers are isolated from the internet.
Free. Save your status, tasks and notes.
Why it matters
Uncontrolled applications on non-internet-facing servers can introduce malware, leading to data breaches and operational disruptions.
How to implement
System owners should identify all applications necessary for business operations on the server.
Create a list of approved applications by consulting with department heads to ensure no essential software is overlooked.
The IT team should configure the server to only allow the execution of these approved applications.
Use security software that can enforce this rule and regularly update it to include new authorised applications.
Managers should hold regular check-ins with the IT team to ensure the application list is current.
This can be done through quarterly reviews to capture any changes in software needs or updates.
The IT team should ensure there is a monitoring process in place to alert them of any attempts to run unapproved applications.
Implement alerts that notify the appropriate personnel immediately when an unauthorised application is detected.
System owners should plan and conduct training sessions for all relevant staff on the importance of application control.
Use real-life scenarios to illustrate the risks of failing to adhere to approved applications lists.
Keep it running
Regularly audit application control allowlists on non-internet-facing servers; alert on blocked executions and investigate newly installed binaries.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the approved applications list for the server: Ensure it is comprehensive and agrees with business needs.
Look at
Date stamps indicating recent reviews.
Good evidence
A current, dated list that matches the latest software needs of the organisation.
- Check 2 of 5What an auditor asks for
Look at
Rules that block unauthorised applications.
Good evidence
Settings show clear restriction to only approved software, with automated alerts for any breaches.
- Check 3 of 5What an auditor asks for
Ask for
How the IT team monitors application use.
Look at
Logs or reports from monitoring tools.
Good evidence
Logs show regular checks without any unauthorised application incidents over the last review period.
- Check 4 of 5What an auditor asks for
Look at
Attendance records and update logs.
Good evidence
Meeting minutes showing discussions and decisions on applications list updates.
- Check 5 of 5What an auditor asks for
Ask for
Records of staff training on application control.
Look at
Participation rates and content coverage.
Good evidence
Training records showing high participation and topics covering real-world risks and application control measures.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML3.1, Application control is implemented on non-internet-facing servers, which asks for the same thing.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-AC-ML3.1.
ISM-1656 requires organisations to implement application control on non-internet-facing servers to prevent unauthorised code from executing on those secure server environments. E8-AC-ML3.1 states the same requirement for non-internet-facing servers and is the Essential Eight control that directly corresponds to this ISM expectation. The scope, asset class (servers), and exposure condition (non-internet-facing) align closely, making them effectively interchangeable for this outcome.
This control partially meets E8-AC-ML3.2.
E8-AC-ML3.2 requires application control to restrict the execution of drivers to an organisation‑approved set to prevent unauthorised code running in kernel context. ISM-1656 requires application control to be implemented on non‑internet‑facing servers, which would typically include controlling executable content such as drivers as part of that deployment. ISM-1656 is broader in scope (where to deploy application control), while E8-AC-ML3.2 is a specific application control outcome focused on driver execution restrictions.
This control partially overlaps E8-AC-ML1.1.
ISM-1656 requires application control on non-internet-facing servers to prevent unauthorised application execution in secure server contexts. E8-AC-ML1.1 applies the same security mechanism (application control) but targets workstations instead of servers. The controls overlap in intent and technique, but differ materially in asset scope (server vs endpoint), so implementing one does not assure compliance with the other.
This control partially overlaps E8-AC-ML2.1.
ISM-1656 requires application control to be implemented on non-internet-facing servers to reduce execution of unauthorised software in server environments. E8-AC-ML2.1 also requires application control, but it applies to internet-facing servers rather than non-internet-facing servers. They overlap on the same technical mechanism (application control on servers), but each addresses a different server exposure profile and neither fully satisfies the other's scope.
This control supports E8-AC-ML2.2.
ISM-1656 requires application control to be implemented on non-internet-facing servers to stop unapproved code from running. E8-AC-ML2.2 specifies how application control is applied across locations (excluding user profiles and temporary folders), which influences the effectiveness and coverage of application control where it is implemented. It supports ISM-1656 by guiding deployment scope decisions for application control, but it is not the same requirement as implementing it on non-internet-facing servers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.