PRO-07 Protect

Trustworthy software

Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised.

Enterprise IT actions

IT.PRO-07.1

Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
ASD’s indicators

Not effective
- Unsupported, unverified or unauthorised software can execute without restriction.
- The list of approved software does not exist.
Partially effective
- Execution restriction controls are deployed but do not cover all applicable assets.
- The organisation maintains a list of approved software, but it has not been reviewed within timeframes defined by the organisation.
- Execution restrictions are in place but integrity verification of approved software is not performed.
- Exceptions to execution restrictions are granted without formal approval or time-bounding.
Fully effective
- Controls restrict execution to supported, organisation-authorised and integrity-verified software on all applicable assets.
- The organisation maintains a list of approved software and reviews it within the timeframes defined by the organisation.
- Integrity of permitted software is verified using trusted mechanisms appropriate to the software and its source.
- Exceptions are formally approved, documented, time-bound and reviewed on a regular cycle defined by the organisation.
Related frameworks

NIST CSF 2.0
PR.PS-01, PR.PS-05, DE.CM-09
NIST SP 800-171r3
03.04.08, 03.04.06, 03.16.01, 03.14.02
AESCSF v2
ARCHITECTURE-3m, ARCHITECTURE-4g, ARCHITECTURE-3b
Essential Eight
Application control, Restrict Microsoft Office macros
MITRE ATT&CK
T1685 Disable or Modify Tools, T1204 User Execution, T1059 Command and Scripting Interpreter, T1047 Windows Management Instrumentation, T1055 Process Injection, T1218 System Binary Proxy Execution

Rate this action in the Navigator
IT.PRO-07.2

Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations.
- Phase 1Boundary services, Identity services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
ASD’s indicators

Not effective
- No approved administrative toolset is defined.
- No restrictions are placed on the location administrative tooling can be executed from.
- No controls prevent unapproved administrative tools, including tools commonly used in post-compromise activity, from executing on managed assets.
Partially effective
- An approved toolset is defined but not consistently enforced across all assets.
- Administrative tooling is configured to execute from known locations, but privileged users can still run tooling from unapproved locations.
- Some unapproved administrative tools are blocked but enforcement gaps exist.
Fully effective
- A defined and enforced approved toolset exists for administrative and management activities, and execution is limited to authorised, known locations.
- Administrative and management tooling outside the approved set is blocked from execution, including from unauthorised locations.
Related frameworks

ISM
ISM-0846, ISM-1392
NIST CSF 2.0
PR.AA-05, PR.PS-01, PR.PS-05, DE.CM-09
NIST SP 800-171r3
03.04.08, 03.01.06, 03.07.04, 03.04.05
AESCSF v2
ARCHITECTURE-3m, ARCHITECTURE-3c, ACCESS-1g
Essential Eight
Restrict administrative privileges, Application control
MITRE ATT&CK
T1685 Disable or Modify Tools, T1204 User Execution, T1059 Command and Scripting Interpreter, T1047 Windows Management Instrumentation, T1055 Process Injection, T1218 System Binary Proxy Execution

Rate this action in the Navigator

Operational technology actions

Action 1

Ensure only approved and integrity-verified software is permitted to execute on systems that support it, with exceptions minimised, risk-accepted, time-bound and regularly reviewed.
- Phase 1Critical processes and services
- Phase 2Privileged environments
Rate this action in the Navigator

Cloud actions

Action 1

Restrict administrative and management tooling to approved software sets and executed only from authorised privileged systems.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems, User devices
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 2

Regularly review proposed and approved software and application integrations in the organisational environment
- Phase 1Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 3

Permit only supported, verified and organisation-authorised software to execute, with exceptions minimised risk-accepted, time-bound, monitored and regularly reviewed.
- Phase 1Identity services, Boundary services
- Phase 2Critical processes and services, Privileged environments
- Phase 3Business systems
- ResponsibilityPaaS: Supplied, SaaS: Supplied
Rate this action in the Navigator

Open the Navigator

More Protect principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.