Skip to content

Application Control

What is Application Control?

Security measures that restrict which applications can execute on systems, preventing unauthorized or malicious software from running.

Information Security

Frameworks that govern application control

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on application control

Requirements naming application control across 6 standards, quoted from the control text.

ACSC Essential Eight19 controls

Microsoft’s vulnerable driver blocklist is implemented. Required at Maturity Level Three of the Application control mitigation strategy (Appendix C); ISM control ISM-1659 in ASD's Essential Eight to ISM mapping (December 2023).

acsc-essential-eight::E8-APP-ISM-1659 · Application control (ISM-1659): Microsoft’s vulnerable driver blocklist is implemented →
Australian Information Security Manual9 controls

Application control restricts the execution of drivers to an organisation-approved set.

ISM-1658 · Application control for drivers →
Protective Security Policy Framework (PSPF) Release 20262 controls

Requirement 0103 (Part Four: Technology, section 14.2.5 Cyber Security Strategies; applies to All entities; dated 31 October 2024; retained from Release 2025): Application control mitigation strategy is implemented to Maturity Level Two under ASD's Essential E...

protective-security-policy-framework-pspf-release-2026::0103 · 0103 Essential Eight: application control to Maturity Level Two →
ASD Strategies to Mitigate Cyber Security Incidents1 control

Application control to prevent execution of unapproved/malicious programs including .exe, DLL, scripts and installers.

ASD37-01 · Application control (Essential) →
MITRE ATT&CK1 control

Apply ATT&CK Mitigations (M-IDs) for prevention and risk reduction. M1015 Active Directory Configuration + M1018 User Account Management + M1027 Password Policies + M1056 Account Use Policies + M1017 User Training + M1036 Account Use Policies + M1042 Disable o...

MITRE-ATTACK-Mitigations-M-IDs-Active-Directory-User-Account-Management-Password-Policies-Network-Segmentation · MITRE ATT&CK Mitigations + M-IDs + Active Directory + User Account + Password + Network Segmentation + Application Control →
COBIT 20191 control

Solutions are installed, configured and joined up with business process activities, and control, security, privacy and auditability measures are put in place while hardware and infrastructure software are configured and integrated, so that resources are protec...

cobit-2019::BAI03.05 · BAI03.05 Build solutions →

Questions people ask about application control

What is Application Control?
Security measures that restrict which applications can execute on systems, preventing unauthorized or malicious software from running.
Why is Application Control important for compliance?
Application Control is a key concept in Information Security. Understanding application control helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Application Control?
Application Control appears in the requirement text of ACSC Essential Eight, Australian Information Security Manual, Protective Security Policy Framework (PSPF) Release 2026, ASD Strategies to Mitigate Cyber Security Incidents, MITRE ATT&CK. Across these standards we have identified 33 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Application Control?
Explore our compliance framework pages to see how application control applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Application Control applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.