ASD ISM 1870 Implement application control for user profiles and folders
What it says
Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure user and temporary folders for systems, browsers, and emails are secured via application control.
This control is about making sure that only approved programs can access the parts of your computer where temporary files and user data are stored. Why is this important? If unauthorised programs get into these folders, they can easily cause harm by stealing information or spreading malware.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised access to user profiles and temporary folders can enable malware execution and data theft, rapidly compromising sensitive business operations.
How to implement
IT team should review all current applications on user devices to make sure they are approved and necessary.
They can do this by creating a list of all installed software and cross-checking it against a list of approved applications.
System administrators should set up application control tools that restrict which programs can run in users' temporary folders.
They can configure these tools to allow only applications from a pre-approved list to execute.
IT staff should work with department managers to inform employees about the importance of not downloading unauthorised software.
They should create simple guidelines or a short training session to explain the risks and safe practices.
The IT team should conduct a quarterly check of user profiles and folders to ensure compliance with application controls.
They can use automated tools to scan for non-approved software and take corrective action if necessary.
Cyber security officers should work with leadership to reinforce these controls as part of a broader application control policy.
They should ensure policies are documented, communicated, and accessible for all staff to understand the rules and reasons.
Keep it running
Maintain application control rules for user profiles and temporary folders; allow only approved apps, and review logs for unauthorised access attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The application control policy document: Request the document that outlines the applications allowed and restricted within user profiles and temporary folders.
Look at
A clear list of permitted applications and any stipulations on temporary folder usage.
Good evidence
Is a detailed, up-to-date policy with input from IT and leadership.
- Check 2 of 5What an auditor asks for
Ask for
Records of application reviews: Request the logs or reports showing the review of applications installed on systems.
Look at
Evidence that these reviews occurred regularly and covered all user devices.
Good evidence
Includes comprehensive and dated logs showing approvals and exceptions.
- Check 3 of 5What an auditor asks for
Ask for
To see the configuration settings of the application control tool: Request a demonstration of how the tool restricts access to user profiles and temporary folders.
Look at
The specific rules set up to block unauthorised applications.
Good evidence
Is settings that clearly enforce the control's requirements.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request proof of staff training on the risks of unauthorised software and application control policies.
Look at
Completion records or training attendance lists signed by employees.
Good evidence
Shows that regular and mandatory training sessions were provided.
- Check 5 of 5What an auditor asks for
Ask for
Recent security audit or incident reports: Request documents that cover any findings related to application control violations in recent audits or security incidents.
Look at
Documented incidents of breach and the corrective actions taken.
Good evidence
Includes detailed reports with resolved incidents and improved controls.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML1.2, Application control is applied to user profiles and temporary folders, which asks for the same thing.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-AC-ML1.2.
ISM-1870 requires application control to be applied to user profiles and temporary folders used by operating systems, web browsers and email clients. E8-AC-ML1.2 states the same requirement with the same locations and technology focus. Both controls are aligned in scope and intent, preventing execution from user-writable and temporary paths commonly abused by malware.
This control supports E8-AC-ML1.3.
ISM-1870 requires application control coverage specifically for user profiles and temporary folders used by operating systems, web browsers and email clients. E8-AC-ML1.3 establishes the foundational requirement to restrict execution of applications and scripts to an organisation-approved set across relevant content types. Implementing ISM-1870 in practice depends on having an application control capability and ruleset as described by E8-AC-ML1.3, with ISM-1870 then refining where it must be enforced.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.