Application control

search account_circle

boltEssential 8

Application control

19 controls in this part of theEssential Eight. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Application control is implemented on workstations.

Make sure only approved software can run on office computers.

Application control is applied to user profiles and temporary folders

Ensure application control covers user and temporary folders to block unapproved software.

Ensure only approved applications and scripts can run

Allow only company-approved applications and scripts to run on work computers.

Application control is implemented on internet-facing servers

Ensure only approved applications can run on servers accessible from the internet.

Application control excludes user profiles and temporary folders

Ensure application control is in place everywhere except user profiles and temp folders.

Microsoft's recommended application blocklist is implemented

Implement Microsoft's recommended blocklist to enhance security.

Annual validation of application control rulesets

Check once a year or more that rules for allowing or blocking software are accurate.

Allowed and blocked application control events are centrally logged

Ensure all application control events are logged in a central location for monitoring.

Event logs are protected from unauthorised modification and deletion

Ensure that event logs are secure from being changed or deleted by unauthorized users.

Event logs from internet-facing servers are analysed to detect cybersecurity events

Review logs from internet servers quickly to spot any security issues.

Cybersecurity events are analysed in a timely manner

Timely analysis of events to spot and manage security incidents.

Cyber security incidents are reported promptly to CISO

Report security incidents quickly to the security chief or their team.

Report cyber security incidents to ASD quickly

Notify ASD promptly when cyber security incidents occur or are discovered.

Cybersecurity incident response plan is enacted after incident identification

Activate the cybersecurity response plan as soon as an incident is identified.

Application control is implemented on non-internet-facing servers

Ensure only approved software can run on internal servers.

Application control restricts driver execution to an approved set

Ensure only approved drivers can run to prevent malicious code execution.

Microsoft's vulnerable driver blocklist is implemented

Use Microsoft's blocklist to stop vulnerable drivers from running.

Event logs from non-internet-facing servers are analysed

Check server logs regularly to find security issues early.

Workstation event logs are promptly analysed for security events

Quickly check workstation logs to find any security events.

Back to the full ASD Essential Eight control list, or browse the complete control library.