Control 3.4.8

★What This Means in Plain English

You must have a policy that either blocks known bad software (blacklisting) or only allows known good software (whitelisting). Whitelisting is stronger because it blocks everything that has not been explicitly approved.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Sophos XDR application control using a deny-all, permit-by-exception (whitelisting) approach
• Microsoft AppLocker policies enforcing executable and script whitelisting on workstations
• Group Policy Software Restriction Policies as a secondary enforcement layer
• ComplianceArmor maintaining the approved software list with version requirements
• Quarterly review of the approved software list to add new requirements and remove obsolete entries

🔎Assessment Guidance

Assessors will verify that application control is enforced (whitelisting or blacklisting), test that unauthorized applications are blocked from executing, review the approved/blocked software list, and check that the policy is consistently applied across all endpoints.

⚠Common Implementation Gaps

• No application control or software restriction policies
• Blacklist only approach with an incomplete blocklist
• Application control deployed but not enforced (audit mode only)
• Approved software list not maintained or updated
• Application control bypassed by running scripts or portable executables

⇄Cross-Framework Mapping