ASD ISM 2115 Restrict server application extensions to an approved set
What it says
Extensions for server applications are restricted to an organisation-approved set.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly extensions (add-on components) that your organisation has formally approved may be installed and run in your server applications.
Many server applications (the programs running on your business servers, such as web servers and database tools) can be expanded with "extensions", extra add-on components that add features. This control says you should keep a list of which extensions your organisation has approved, and block any that are not on that list. This matters because unapproved or unknown extensions are a common way attackers sneak harmful code onto your servers, so limiting them to a trusted, approved set shrinks the ways your systems can be attacked.
Free. Save your status, tasks and notes.
Why it matters
If server applications can run any extension, an attacker or careless install can add harmful add-on code to your servers, leading to compromised systems, stolen data, or downtime.
How to implement
The IT manager should create a written, approved list of server application extensions, naming each allowed extension and the business reason it is needed, and have a senior person such as the business owner or board sign off on that list.
The system administrator should configure each server application so that only the extensions on the approved list can load, using the application's built-in settings (for example an allow-list or by removing the install permissions for everyone else).
Whoever manages the servers should run a check across all servers to find extensions already installed, compare them against the approved list, and remove or disable any extension that is not approved.
The IT manager should set up a simple request-and-approval process so that when staff need a new extension they submit it for review, and it is only added to a server once it has been added to the approved list.
The system administrator should schedule a regular review (for example every quarter) to re-check installed extensions against the approved list and remove ones that are no longer needed or supported.
Keep it running
Keep the approved list current as business needs change, re-check installed extensions against it on a regular schedule, and remove extensions that are no longer needed or supported.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the organisation's approved list of server application extensions.
Look at
whether it names specific extensions, gives a business reason for each, and has been signed off by someone with authority.
Good evidence
is a current, dated list with clear ownership and approval.
- Check 2 of 5What an auditor asks for
Ask for
how the server applications are configured to block extensions that are not approved.
Look at
the actual application settings or allow-list configuration on a sample server.
Good evidence
shows the technical restriction is switched on, not just written in a policy.
- Check 3 of 5What an auditor asks for
Ask for
a recent scan or inventory of extensions actually installed on the servers.
Look at
whether every installed extension also appears on the approved list.
Good evidence
shows the installed set matches the approved set with no unexplained extras.
- Check 4 of 5What an auditor asks for
Ask for
how a new extension gets approved and added to a server.
Look at
a real example of a request that was reviewed, approved, and added to the list.
Good evidence
shows a documented request-and-approval trail rather than ad hoc installs.
- Check 5 of 5What an auditor asks for
Ask for
when the approved list was last reviewed and who did it.
Look at
review dates, notes, and any extensions that were removed.
Good evidence
shows a recent review on a regular schedule with evidence that unneeded extensions were taken out.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML1.3, Ensure only approved applications and scripts can run, which partially overlaps with this control.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-AC-ML1.3.
ISM-2115 requires server application extensions to be restricted to an organisation-approved set to prevent unauthorised add-ons from being installed or executed. E8-AC-ML1.3 similarly enforces allow-listing by restricting executables, libraries and scripts to an approved set, which can include extension modules depending on the platform. The overlap is strongest where extensions are implemented as loadable libraries or plugins governed by application control, but E8-AC-ML1.3 is broader than extensions and applies across many file types and endpoints, while ISM-2115 is specifically about server application extensions.
This control partially overlaps E8-AC-ML2.1.
ISM-2115 requires restricting server application extensions to an organisation-approved set to reduce the attack surface on servers. E8-AC-ML2.1 supports this by mandating application control on internet-facing servers, which provides a technical mechanism to prevent unapproved extension binaries or plugin components from executing. E8-AC-ML2.1 is about where application control must be implemented, whereas ISM-2115 is about governing the specific class of 'extensions' within server applications.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.