Application control
Application control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else. In Cyber Essentials v3.3 it is called application allow listing: only approved applications, restricted by code signing, may run. It is a malware protection option for any device, option B at A8.1, checked at A8.4 and A8.5.
- Term
- Application control
- Also known as
- Application allow listing, Application whitelisting, App control
- Category
- Malware, cloud and threats
- Requirement area
- 5. Malware protection
- Reviewed against
- Requirements v3.3
What does the term application control mean in Cyber Essentials?
Application control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.
How does application control apply to Cyber Essentials?
In plain terms
It is a guest list for software. Instead of trying to spot every troublemaker, the device only lets in programs whose names are on the list. Anything else, including new malware nobody has seen before, does not start. Common examples are the app store rules on phones, Microsoft Intune app policies, and Windows features such as App Control for Business and AppLocker.
What Cyber Essentials asks
The requirements call this application allow listing and describe it as an "option for all in scope devices". The rule is: "Only approved applications, restricted by code signing, are allowed to execute on devices." You must "actively approve such applications before deploying them to devices" and "maintain a current list of approved applications, users must not be able to install any application that is unsigned or has an invalid signature".
Code signing is a digital seal from the software publisher that shows who made a program and that nobody has changed it since.
A8.4 asks whether users are restricted from installing unsigned applications. A8.5 asks whether users only install approved applications and whether you keep the approved list. The A8.5 guidance says you do not have to use MDM "if you can meet the requirements using good policy, processes and training of staff."
What an assessor looks for
At Cyber Essentials Plus, sub-test 3.2 checks that the trusted root certificate list is the operating system's standard set or a subset of it, that extra root certificates were added only with your explicit agreement, and that an unsigned executable will not run.
See the malware protection requirements and Microsoft Intune setup. Related: allow listing, mobile device management.
Related terms
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
- Attack surfaceAn attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
- BackupA backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
Frequently asked questions
Application control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.
In the 2026 Danzell question set, application control comes up at A8.1, A8.4, A8.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Application control relates to 5. Malware protection in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.