Module 5 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: the three controls that stop unwanted code running (application control, restrict Microsoft Office macros, user application hardening), an honest account of why application control is the hardest and most disruptive of the eight for a small business, how to roll it out by monitoring before blocking, what macro restriction actually means, plain-English hardening for browsers, PDF readers and Office, and a sensible order to tackle them in.
What Is Allowed to Run
Three controls, one job
Three of the eight controls share a single job: stopping code you never asked for from running on your computers. Application control, restrict Microsoft Office macros, and user application hardening.
Everything in the last two modules was about closing the ways in. These three assume something got through anyway, which it eventually will, and try to make sure it cannot do anything once it lands. That is a very different kind of protection, and it is the reason this group exists on the list at all.
Only approved software is allowed to run, and everything else is blocked by default. Not blocked because it looks suspicious, blocked because it is not on the list. This is the strongest of the three and easily the hardest to live with.
Macros are small programs that live inside Office documents. They were built to save people typing, and they have been used to deliver malware for a very long time. The control is about allowing only the ones you genuinely need.
Turning off features in browsers, PDF readers and Office that almost nobody uses and attackers rely on. Not new software, not new spending, just switching off doors nobody in your business walks through anyway.
Antivirus works by recognising things it knows to be bad, so brand new malware gets a head start. Application control works the other way around. It allows what you have approved and blocks everything else, which means it does not need to have seen the threat before. That is the appeal, and it is also exactly why it is disruptive, because "everything else" includes plenty of software your team actually wanted.
Let us be straight about this one, because plenty of security advice is not. Application control is the most effective of the eight controls and the most disruptive thing you will do to your business in the name of security. Both of those are true at once.
If you have ever wondered why a business can be genuinely well run and still not have application control in place, this is why. It is not laziness. It is a real trade between a strong protection and a real cost in time, tooling and friction, and it deserves an honest conversation rather than a tick box.
An approved list, and everything else stops
You build a list of the software your business is allowed to run, and the operating system enforces it. Ransomware that lands on a laptop simply does not start, because it was never on the list. No detection, no signature, no judgment call.
- It covers executables, scripts, installers and libraries, not just obvious programs
- It works against brand new malware nobody has ever seen
- Attackers respond by trying to abuse software that is already approved
This is the hardest control on the list for a small business
Every piece of software your team uses has to be known, approved and maintained on that list. The accounting add-in, the machinery vendor's tool, the thing a contractor installs on a Wednesday. When something is missing, it does not run, and someone is standing at your desk about it.
- Expect real disruption in the first few months, not a quiet rollout
- Somebody has to own approvals ongoing, or it slowly stops being enforced
- It needs central management, so it is not a weekend job on individual laptops
Watch first, block second
Most tools can run in a mode where they log what would have been blocked without actually blocking it. Leave it there for a while and you get an accurate picture of what your business really runs, which is never the list anyone predicted.
- Start with monitoring only, and read the results before enforcing anything
- Start with the places that matter most, rather than everywhere at once
- Keep a fast, human way to get something approved, or people will find a way around it
Application control gets switched on, three people cannot do their jobs by Thursday, and the quickest fix is to approve whole folders that anyone can write to. The tool is still running, the dashboard still looks green, and the protection is effectively gone. Which systems it must cover, and how tightly, is set out by maturity level in the model, so check the current version before deciding what "done" means for you.
Good news after that last unit. These two controls are far easier, cost nothing in licensing, and remove a disproportionate amount of risk. They are also the two most likely to be quietly skipped, because neither produces anything anyone can point at.
First, macros. ASD calls this control restrict Microsoft Office macros, and the wording matters, because it is not "configure the settings and move on". A macro is a small program inside a spreadsheet or document. Genuinely useful ones exist, usually in finance, usually written years ago by someone who has since left. They are also a reliable way to get code running on a machine when the file arrives by email and the person opening it has every reason to expect an invoice.
- Macros in documents that arrive from the internet should not run, full stop
- Work out who genuinely needs macros, which is usually a much shorter list than expected
- Allow the ones you need from a trusted location, or because they are digitally signed by someone you trust
- Stop ordinary staff being able to change the macro settings themselves
- Keep a log of macro activity, so somebody can see what has been running
Second, user application hardening. The name sounds like a project. It is really a list of settings you turn off in software you already have, and the pattern is always the same: a feature that made sense when it was built, that almost nobody in your business uses, and that attackers use constantly.
Browsers are the most exposed software you own. Hardening means blocking web adverts, which are a genuine malware delivery route, stopping the browser from running old technologies from the internet, and locking the settings so they stay that way after someone goes exploring.
A PDF is not just a page of text. Readers can run scripts and open other content, which is far more capability than anyone needs to read an invoice. Turning that off costs nothing and removes a very well used delivery method.
Office can embed and launch other content inside a document, which is another old convenience feature with a long history of misuse. Hardening switches off the parts your team does not use, while leaving Word and Excel behaving exactly as they always have.
The first is thinking it will annoy staff. Done properly, almost nobody notices, because the features being removed are ones your team has never deliberately used. The second is doing it once, on a few machines, by hand. Settings drift, new laptops arrive with defaults, and someone eventually turns something back on. Push it centrally and lock it, or it quietly undoes itself over a year. Exactly which settings are required at which maturity level sits in the model, so check the current version.
If you are looking at these three and wondering where to start, start where the effort is smallest and the benefit is immediate. That is not the order ASD lists them in, and that is fine. ASD's order reflects effectiveness, not your Tuesday.
- Block macros in anything that arrives from the internet
- Turn off scripting and embedded content in your PDF reader
- Harden the browser centrally, including blocking web adverts
- Push the settings from one place and stop staff changing them back
- Application control, with a monitoring period before anything gets blocked
- A named person who can approve new software quickly when someone needs it
- A written list of what is approved, kept current rather than written once
- Budget and time set aside, because doing it badly is worse than not yet doing it
This is the group of controls where that phrase usually hides something. Plenty of businesses have the macro and hardening settings sorted and no application control at all, then describe themselves as aligned. If you are answering a questionnaire, say what you have done and what you have not. Being specific reads as competence. Being vague reads as something else, especially to a security team that does this all day.
Remember too that ASD expects the same maturity level across all eight controls before you climb higher. Application control being the hard one does not mean it can be left behind indefinitely, but it does mean it is reasonable to be honest about where you are while you plan the work properly.
- cyber.gov.au: Essential Eight explained, Australian Signals Directorate
- cyber.gov.au: Essential Eight maturity model, including the requirements for each control by level
Current at the time of writing (August 2026). ASD updates the maturity model regularly, and the specific settings required for application control, macros and hardening sit in its appendices by maturity level, so read them there rather than relying on a summary.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. How does application control differ from antivirus?
2. Why is application control considered the hardest of the eight for a small business?
3. A business turns on application control, then approves whole folders that anyone can write to so people stop complaining. What has happened?
4. What is the core idea behind restricting Microsoft Office macros?
5. Which of these best describes user application hardening?