Allowlist Authorized Software
Description
Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
Apple device management platform for macOS and iOS endpoint configuration, security, and software deployment
Jamf · Per-device subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Execution of Weaponized Applications
IntegrityWithout application allowlisting, users can execute malicious binaries delivered via phishing, watering hole attacks, or USB drops, leading to full system compromise.
Living-off-the-Land Binary (LOLBin) Abuse
ConfidentialityAttackers leverage non-allowlisted but present system utilities and tools to execute malicious payloads while evading detection by traditional antivirus solutions.
Ransomware Payload Execution
AvailabilityRansomware executables delivered through email attachments or exploit kits run unrestricted on endpoints without allowlisting controls, encrypting critical business data.
Vulnerabilities (When Safeguard Absent)
No Technical Controls Preventing Unauthorized Software Execution
Without allowlisting, any executable binary can run on enterprise assets, meaning the only barrier to malicious code execution is user judgment and reactive antivirus.
Overly Permissive Application Execution Policy
A default-allow execution model permits any application to run, dramatically expanding the attack surface beyond what is necessary for business operations.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Record | Access review/recertification records with sign-off | Quarterly |
| Technical | Access control configuration evidence (RBAC settings, group memberships) | Reviewed quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |