What is the difference between application control and user application hardening in the Essential Eight?

Application control decides which software is allowed to run at all, based on trust and approval. User application hardening changes how approved software behaves by reducing risky settings and adding protections such as encryption or MFA where appropriate. One is a gatekeeper control, the other is a hardening control that reduces abuse of software already in use.

How the two Essential Eight controls differ in practice

application control is about deciding what may execute. user application hardening is about constraining the behaviour of software that is already approved to run. That distinction matters because the first control reduces the number of programs that can become an attack surface, while the second reduces the ways a permitted program can be abused once it is trusted.

Put simply, application control works at the entry point, and hardening works inside the permitted set. A device can have strong hardening and still be exposed if untrusted software is allowed to launch. Likewise, a restrictive allow list still leaves room for risky defaults, enabled features, or weak browser and document settings inside approved applications.

For practical administration, the two controls often complement each other. Many environments need both a clear software allow model and a separate baseline for approved applications, especially where users rely on browsers, document readers, scripting-capable tools, or remote access clients that are common abuse targets.

Why each control reduces a different kind of exposure

Application control is strongest when the main concern is unauthorised code execution, including commodity malware, unapproved tooling, and software that bypasses standard procurement or packaging paths. It is a policy enforcement control, so its value depends on how clearly software trust can be defined and maintained over time.

User application hardening is strongest when the concern is abuse of legitimate software features, such as macro execution, excessive browser capability, unsafe content handling, or unnecessary integration points. Rather than stopping the application entirely, it narrows the options available to an attacker or careless user who is already operating inside a trusted program.

The difference shows up in failure mode. If application control is too permissive, unmanaged software can run. If hardening is too weak, approved software can still be leveraged as a delivery or execution path. In both cases, the control gap may look like “the application was allowed”, but the root cause is different.

How to choose the right control focus for a given system

Systems with stable software inventories and tightly managed endpoints usually benefit most from application control first, because they can enforce a smaller and more predictable runtime set. Systems with more reliance on broad productivity tools usually need stronger hardening because those tools remain necessary even when the application list cannot be made very small.

Hardening should be treated as a behaviour control, not a replacement for allow listing. For example, locking down scripting, disabling risky document features, or requiring stronger authentication inside an approved application reduces abuse, but it does not answer the question of whether the software itself should be permitted in the first place.

In the CISA Secure by Design model, the useful mental pattern is to make safe defaults the norm, then reduce the number of opportunities for unsafe execution or unsafe behaviour. That fits application control and hardening as separate but reinforcing decisions.

Risk and Threat Considerations

The main risk is confusing “approved” with “safe”. An application can be authorised to run and still expose the organisation if its risky features remain enabled, or if its vendor, plug-ins, macros, extensions, or update path introduce abuse opportunities. Conversely, a hardened application set can still be undermined if users can install or launch untrusted software outside the allow list.

Failure mechanism: attackers either bring in software that should never have been allowed to execute, or they abuse trusted software functions that were left too permissive for the business need. Both paths can lead to malware execution, data access, persistence, or credential theft, but the control failure is different in each case.

Impact: when application control is weak, the endpoint runtime becomes noisier and harder to govern; when hardening is weak, a trusted application becomes a reliable abuse channel. Either gap increases the chance that ordinary user workflows become a route to compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-2 — Inventory and Control of Software Assets	Application control depends on knowing and controlling what software is present.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	User application hardening is fundamentally secure configuration of approved software.
Recommendation — Maintain an approved software inventory and remove or block unapproved executables. Apply hardened configuration baselines to approved applications and endpoints.
NIST SP 800-53 Rev 5	CM-7 — Least Functionality	Application control and hardening both reduce unnecessary software capability and execution paths.
	CM-6 — Configuration Settings	Hardening uses secure configuration settings to reduce abuse of approved software.
Recommendation — Disable or prohibit functions, services, and software not required for mission needs. Define and enforce secure baseline settings for approved applications and platforms.
ISO/IEC 27001:2022	A.8.9 — Configuration management	The distinction hinges on managing approved software and its secure settings.
Recommendation — Maintain controlled baselines for software approval and secure configuration.

Practitioner Guidance

What to prioritise: Treat application control as the decision about software trust, and user application hardening as the decision about acceptable behaviour inside trusted software. If you only have bandwidth for one immediate improvement, start where the highest-risk software execution path is least controlled.

What to verify: Confirm that the allow list, publisher trust, or execution policy is actually enforced at runtime, then verify that approved applications have risky features disabled by default where business use does not require them. A control that exists only in policy documents is not operationally meaningful.

Common mistake: teams often harden a browser or office suite and assume the endpoint is covered. That leaves the organisation exposed if other executable paths remain open, or if users can introduce portable tools, scripts, or unsupported installers.

Practitioner takeaway: The cleanest way to think about the distinction is that application control limits what can enter execution, while user application hardening limits what trusted software can do once it is already there.