---
title: "Essential Eight application control explained | CCP"
description: "What application control is, what changes at Maturity Level 1, 2 and 3, and how to roll it out without breaking the software your staff rely on."
url: "https://ccp.com.au/essential-eight/application-control/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight application control

## If it isn’t approved, it doesn’t run.

Application control is an allowlist. Only the programs, scripts and installers you have approved can run on your computers. Everything else is blocked.

At a glance

Control

01 of 08 · Prevent attacks

Stops

Ransomware, malicious scripts, unapproved installs

Typical tools

Windows Defender Application Control or AppLocker, through Intune

Effort

High, needs careful testing

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What is application control?

### Where it stops an attack.

1.  The attack A phishing email drops a program into a user’s Downloads folder and tries to run it.
3.  Stopped here The program isn’t on the approved list, so Windows refuses to run it.
5.  The result No ransomware, no stolen passwords, no back door.

## Application control maturity levels

### What changes at each level.

What changes ML1 ML2 ML3

Where it runs WorkstationsAdds internet-facing serversAdds all other servers

What it controls Programs, scripts, installers, libraries and other executable files No change Adds drivers

Locations covered User profiles and temporary foldersEvery location No change

Microsoft blocklists Not required Recommended application blocklistAdds the vulnerable driver blocklist

Rules reviewed Not required At least once a year No change

Logging Not required Allowed and blocked events logged centrally. Internet-facing server logs analysedAdds analysis of workstation and internal server logs

Each level includes everything in the one before. A plain-English summary, not the requirement text. [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

[Check where you are with the free self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## How to implement application control

### Protection first, disruption last.

1.  01

    #### Run in audit mode first

    Record every application, script and installer the business uses before blocking anything.

2.  02

    #### Build the allowlist

    Allow by publisher certificate where possible, so routine vendor updates don’t break.

3.  03

    #### Enforce in waves

    Start with one team, fix what breaks, then roll out to the rest.

4.  04

    #### Handle exceptions by ticket

    A quick request process for new software, so nobody works around the control.

[Related service: Cyber security services](https://ccp.com.au/services/cybersecurity/)

## Common application control mistakes

### Where rollouts go wrong.

-   #### Going straight to enforce

    Skipping audit mode is how a line-of-business app stops working on a Monday.

-   #### Allowing folders users can write to

    If staff can write there, so can malware.

-   #### Set and forget

    Software changes. The rules need an owner.

## Application control questions

### What clients ask before we start.

### Is application control the same as antivirus?

No. Antivirus blocks software it knows is bad. Application control only allows software you have approved, so it stops threats antivirus hasn’t seen yet. You need both.

### Can we do application control with Microsoft 365?

Yes. Microsoft 365 Business Premium includes Intune, which deploys Windows Defender Application Control and AppLocker policies to managed devices.

### How long does an application control rollout take?

Six to ten weeks for a typical 50-seat business: two weeks of audit mode, two of tuning, then enforcement team by team.