PRO-07 Trustworthy software
2 actions under this Protect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised.
Quoted as published. Everything else on this page is written by Control Stack.
The two actions
- IT.PRO-07.1Restrict Execution to Supported, Verified and Authorised Software with Time-Bound Exceptions
Lets only supported, checked and approved software run on systems, keeping exceptions rare, signed off, time-limited, watched and regularly reviewed.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-07.2Restrict Administrative and Management Tools to Approved Sets and Authorised Locations
Lets only approved admin and management tools run, and only from authorised places such as a dedicated admin computer or protected folder.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices)
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.