ISM-1657 policy ASD Information Security Manual (ISM)

Restrict Application Execution to Approved Set

Only approved software and scripts can run, enhancing system security.

Preventative ML1 ML2 ML3 NC OS P ASD Information Security ManualGuidelines for system hardening application security

record_voice_over

Plain language

This control ensures that only approved software is allowed to run on your organisation's computers. It's important because if unauthorised programs are executed, they could introduce viruses or allow hackers to steal information, causing serious business disruptions.

01 — Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Aug 2025

Control Stack last updated

19 Mar 2026

E8 maturity levels

ML1, ML2, ML3

Guideline

Guidelines for system hardening

Section

Operating system hardening

Topic

Application Control

Official control statement

Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.

policy ASD Information Security Manual (ISM) ISM-1657

priority_high

Why it matters

Without application control (approved allow list), unauthorised executables, scripts or libraries can run, enabling malware, privilege abuse and unauthorised access to systems and data.

settings

Operational notes

Maintain and review the application allow list; test and deploy updates promptly. Verify enforcement blocks unapproved executables, scripts, installers and libraries, and monitor logs for blocked attempts.

02 — Implement

build

Implementation tips

IT team: Compile a list of approved applications that are necessary for organisational tasks. Work with department heads to determine which programs are essential for daily operations and ensure these are the only ones allowed to run.
System owner: Implement application control software to manage which applications can be executed. Use the approved applications list to configure the software to block anything not listed.
Management: Communicate to all staff the importance of using only approved software for their tasks. This can be done via email or a team meeting, highlighting the risks of unauthorised software.
IT team: Regularly review and update the list of approved applications. Set a quarterly meeting with key stakeholders to ensure new software needs are considered and keep the list current.
IT team: Train staff on recognising and reporting attempts to run unauthorised software. Offer workshops or online courses explaining the steps they should take if they receive suspicious software requests.

03 — Audit

fact_check

Audit / evidence tips

Aska copy of the approved applications list: Request the list of software and scripts that are currently approved for use

Goodlist will have software names, version numbers, and approval dates
Aska demonstration of the application control software: Request a live demonstration showing how the software blocks unauthorised applications

Gooddemonstration will show blocked attempts to run unapproved applications
Askresults of the latest review of approved applications: Request documentation of the last review meeting outcomes

Goodincludes a summary of reviewed applications and any changes made
Askto see staff training records on application control: Request evidence of completed training courses or sessions
Askexamples of user reports on unauthorised software attempts

Goodshows that staff are vigilant and reports are being addressed promptly

04 — Mappings

link

Cross-framework mappings

How ISM-1657 relates to controls across ISO/IEC 27001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
sync_alt Partially overlaps (1) expand_less
Annex A 8.18	Annex A 8.18 requires restricting and tightly controlling use of utility programs that can override system and application controls, effe...

E8

Control	Notes	Details
layers Partially meets (3) expand_less

E8-AC-ML1.1	E8-AC-ML1.1 requires implementing application control on workstations to restrict what software can execute
E8-AC-ML1.2	E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders used by operating systems, browsers and ema...
E8-AC-ML2.3	E8-AC-ML2.3 requires implementing Microsoft’s recommended application blocklist to block known unwanted applications
sync_alt Partially overlaps (1) expand_less

E8-AC-ML2.2	ISM-1657 requires application control that restricts execution to an organisation-approved set of executable artefacts
handshake Supports (3) expand_less

E8-AC-ML2.1	E8-AC-ML2.1 requires application control on internet-facing servers to ensure only approved applications run
E8-AC-ML2.4	ISM-1657 requires restricting application execution to an organisation-approved set, which depends on the quality and currency of the all...
E8-AC-ML3.1	E8-AC-ML3.1 requires application control on non-internet-facing servers to ensure only approved software can run
link Related (2) expand_less

E8-AC-ML1.3	E8-AC-ML1.3 requires application control to restrict execution of executables, libraries, scripts, installers, and similar content to an ...
E8-AC-ML3.2	ISM-1657 requires restricting execution to an organisation-approved set for a wide range of application artefacts (executables, libraries...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.