Allow listing (application allow listing)
Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices. Under Cyber Essentials v3.3 you must approve applications before deploying them, keep a current approved list, and stop users installing unsigned software. Phones and tablets usually meet the control this way (A8.1 option B).
- Term
- Allow listing
- Also known as
- Application allow listing, Whitelisting
- Category
- Malware, cloud and threats
- Requirement area
- 5. Malware protection
- Reviewed against
- Requirements v3.3
What does the term allow listing mean in Cyber Essentials?
Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
How does allow listing apply to Cyber Essentials?
In plain terms
Instead of trying to recognise every bad program, the device runs only programs you have approved, and only if they carry a valid digital signature from their publisher. Anything new or tampered with simply does not start. On phones and tablets this is mostly how the device already works: apps come from the platform store and are signed.
What Cyber Essentials asks
Application allow listing is one of the two malware protection options in the requirements and is described as an "option for all in scope devices". The rule: "Only approved applications, restricted by code signing, are allowed to execute on devices. You must: actively approve such applications before deploying them to devices; maintain a current list of approved applications, users must not be able to install any application that is unsigned or has an invalid signature."
The NCSC gives an example: "Acme Corporation implements code signing alongside a rule that allows only vetted applications from the device application store to execute on devices. Unsigned and unapproved applications will not run on devices."
In the question set:
- A8.1 option B selects it. The guidance says most organisations with smartphones and standard laptops select both A and B.
- A8.4 asks whether users are restricted from installing unsigned applications.
- A8.5 asks whether users install only approved applications and whether you keep the list. It "includes employee-owned devices", and MDM is optional "if you can meet the requirements using good policy, processes and training of staff."
What an assessor looks for
A real approved list, even a short one, with a named person who approves additions. At Cyber Essentials Plus, sub-test 3.2 checks each sampled device: the trusted root certificates are the operating system maker's standard set or a subset of it, extra roots were added only with your explicit agreement, an unsigned executable will not run, and code signing applies to all executable file formats.
Common mistakes
- Choosing option B for Windows laptops without any application control actually configured.
- Keeping no list for BYOD phones, which A8.5 covers.
See the malware protection requirements and A8.5. Related: application control, mobile device management, jailbreaking and rooting.
Related terms
- Application controlApplication control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
- Jailbreaking and rootingJailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- Attack surfaceAn attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
Frequently asked questions
Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
In the 2026 Danzell question set, allow listing comes up at A8.1, A8.4, A8.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Allow listing relates to 5. Malware protection in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.