ASD ISM 1871 Implement application control exclusions for system areas
What it says
Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApplication control is set up to avoid certain system areas like user profiles and temporary folders.
This control means you need to set up your software so it doesn't check certain parts of your computer where your personal settings and temporary files are stored. It matters because if the software goes snooping in these areas, it could cause annoying problems like slowing down your computer or interfering with other programs. By keeping these areas off limits, you ensure your system runs smoothly and other important areas are securely monitored.
Free. Save your status, tasks and notes.
Why it matters
Without this control, application control may be bypassed by running code from user profiles or OS/browser/email temporary folders, increasing malware execution risk.
How to implement
The IT team should identify which parts of the computer need to be excluded from software checking.
They can do this by making a list of folders and areas like user profiles and temporary folders that store short-term data.
The IT manager should communicate the importance of these exclusions to staff involved in system upkeep.
Conduct a briefing session explaining why these folders are excluded and how this keeps other systems stable and performing properly.
System administrators need to configure software settings to implement these exclusions.
They can use system tools or configuration settings to specify which areas are to be left unchecked by the application control.
Technical staff should test the configuration to ensure the excluded areas are actually being bypassed by the control software.
They can create trial scenarios to see if the settings work as intended without affecting system performance.
The compliance officer should document this setup process in the organisation's security policy.
This can be done by writing a policy section that explains which areas are excluded and why, helping keep records clear for audits.
Keep it running
Apply application control to system and program locations; only exclude user profiles and OS/browser/email client temporary folders, and review exclusions regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The system configuration report: Request the document or screenshot that shows the list of excluded folders. Look to see the specified areas like user profiles and temporary folders are clearly listed.
Good evidence
The report shows user profiles and temporary folders as excluded areas, and the document is dated and authenticated.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the system settings: Request a walk-through of the actual settings in the control software.
Look at
Visual confirmation that user profiles and such areas are unchecked.
Good evidence
Live demonstration shows the control software with areas ticked off the monitoring list and settings saved.
- Check 3 of 5What an auditor asks for
Ask for
The policy document: Request the section of the security policy that mentions application control exclusions. Look to check that it includes details on why exclusions are necessary.
Good evidence
Policy document is detailed, references relevant folders, and includes management sign-off.
- Check 4 of 5What an auditor asks for
Ask for
Logs of control activities pre- and post-exclusion: Request logs that show how the application control behaved before and after implementing exclusions. Look to verify fewer false positives in performance-sensitive areas.
Good evidence
Logs show a reduction in unnecessary control checks in targeted folders after the exclusions were applied.
- Check 5 of 5What an auditor asks for
Ask for
About training or briefing records: Request evidence of staff training sessions regarding the exclusion policy.
Look at
Records of attendance and the content discussed.
Good evidence
Clear evidence of a training session with attendee names and session notes detailing the exclusion process.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.2, Application control excludes user profiles and temporary folders, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control supports A.8.19.
ISM-1871 requires a specific secure configuration for application control coverage, excluding user profiles and temporary folders to reduce abuse of high-churn paths. Annex A 8.19 requires secure procedures and measures for managing software installation on operational systems, which is strengthened by application control configurations like those in ISM-1871. The ISO control is broader about installation governance, while ISM-1871 is a concrete technical scoping requirement for application control.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-AC-ML2.2.
ISM-1871 requires application control to be applied to all locations except user profiles and temporary folders used by operating systems, web browsers, and email clients. E8-AC-ML2.2 states the same exclusion approach for application control with the same key locations and rationale. Both controls have matching scope and intent (implementing application control broadly while excluding high-churn user/temp paths).
This control partially overlaps E8-AC-ML1.2.
E8-AC-ML1.2 requires application control to be applied to user profiles and temporary folders used by operating systems, web browsers and email clients. ISM-1871 addresses application control scope by emphasising coverage of locations other than those user and temporary folders, effectively focusing on the remainder of the file system. They intersect on the topic of defining application-control coverage, but ISM-1871 is effectively the complement of E8-AC-ML1.2 rather than the same requirement.
This control partially overlaps E8-AC-ML2.1.
ISM-1871 defines where application control should and should not be applied, specifically excluding user profiles and temporary folders. E8-AC-ML2.1 requires implementing application control on internet-facing servers, which is a deployment scope that would need to follow the location-scoping rules in ISM-1871 when implemented. The candidate is about where to deploy application control, while ISM-1871 is about how to scope it within systems.
This control partially overlaps E8-AC-ML3.1.
E8-AC-ML3.1 requires application control to be implemented on non-internet-facing servers so only approved software can execute. ISM-1871 specifies where application control should be applied, focusing on system locations over writable user paths. Both address effective application control, with E8-AC-ML3.1 scoped to non-internet-facing servers and ISM-1871 as a placement rule across endpoints and servers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.