A8.5: Do you keep a list of approved applications that users may install?
If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
If you selected option B in A8.1, answer Yes to A8.5 only if you maintain a current list of approved applications and users install only applications on it, including on employee-owned devices. MDM is one way to enforce it but not required: IASME accepts good policy, processes and staff training. The list must be kept up to date.
Is A8.5 an automatic fail?
No. A8.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must create a list of approved applications and ensure users only install these applications on their devices. This includes employee-owned devices.
- Requirement enforced
- actively approve such applications before deploying them to devices
- maintain a current list of approved applications, users must not be able to install any application that is unsigned or has an invalid signature
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A8.4Back to the malware protection control
What does A8.5 ask?
A8.5 asks: “If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?”
A8.5 asks, where you use an app store or application signing, whether you ensure users only install applications approved by your organisation and maintain the list of approved applications. The guidance says you must create the list and ensure users install only those applications, including on employee-owned devices, and that MDM is optional if good policy, processes and training meet the requirement.
The requirement: actively approve applications before deploying them to devices, and maintain a current list of approved applications; users must not be able to install any application that is unsigned or has an invalid signature. See allow listing.
What must be true to answer Yes to A8.5?
You can answer Yes to A8.5 only when all of the following are true today, across every device, user and cloud service in scope.
- A written list of approved applications exists and is kept current, with an owner.
- Users install only listed apps, enforced by MDM or by policy and training.
- It covers employee-owned phones and tablets that access organisational data.
- There is a way to request and approve a new app.
Why do applicants fail A8.5?
A common reason applicants fail A8.5: no list at all, only 'apps from the store'.
- A list written once and never updated.
- BYOD devices not covered by the list.
- No approval route, so people install what they like.
How do you fix a failing A8.5 answer?
If your answer to A8.5 would not pass today, fix the control first and then write the answer. In order:
- Write the approved application list with an owner.
- Enforce it through an MDM app catalogue, or through policy and training.
- Add a request and approval route for new apps, and include BYOD devices.
How do assessors check A8.5?
What evidence should you keep for A8.5?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A8.5:
- The approved application list, with its owner and last update date.
Where to go next
- Allow listingGlossary
- Microsoft Intune setupSetup guide
- Application controlGlossary
- CE Plus test 3: malware protectionTest files by email and browser
- Malware Protection requirementsThe control this question tests
- All A8 questionsMalware protection
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A8 questions
- A8.1A8.1Multiple choice + notesAre all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:Multiple choice + notes
- A8.2A8.2Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?Yes/No
- A8.3A8.3Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?Yes/No
- A8.4A8.4Yes/NoIf Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?Yes/No
Frequently asked questions
A8.5 in the 2026 Danzell Cyber Essentials question set asks: "If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?" It is a Yes/No question.
If you selected option B in A8.1, answer Yes to A8.5 only if you maintain a current list of approved applications and users install only applications on it, including on employee-owned devices. MDM is one way to enforce it but not required: IASME accepts good policy, processes and staff training. The list must be kept up to date.
No. A8.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's A8.5 guidance says you may use MDM but are not required to if you can meet the requirement with good policy, processes and staff training.
Yes. The A8.5 guidance says it includes employee-owned devices that are in scope.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh