Mobile App Whitelisting
Plain English Translation
Organizations must restrict the mobile applications that employees can install on work devices, or within secure work profiles, to a pre-approved list of trusted sources. This process, often called app whitelisting or allowlisting, prevents malicious or vulnerable software from compromising corporate data by ensuring only vetted applications can be downloaded and used.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Document an acceptable use policy explicitly stating which app stores are considered trusted.
- Instruct employees not to jailbreak devices or sideload applications.
Required Actions (scaleup)
- Deploy Mobile Device Management (MDM) to enforce app restrictions.
- Block access to third-party app stores and disable the ability to install unknown apps (sideloading).
Required Actions (enterprise)
- Implement a custom enterprise app store or utilize Managed Google Play and Apple Business Manager to create a strict allowlist of authorized applications.
- Automatically quarantine devices that are found to have unapproved apps installed.
App allowlisting is the practice of specifying a strict list of approved applications that are permitted to run or be installed on a mobile device, blocking all others by default.
Enforcement is typically achieved using Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) solutions that restrict app installations to a Managed Google Play Store or Apple Business Manager environment. For governance and auditability, tools like WatchDog Security's Compliance Center can map those MDM settings to CSC-06-008 and track evidence, owners, and review cadence.
Android devices can be secured via MDM policies that disable the Install Unknown Apps setting and restrict the device to Android Enterprise Work Profiles, which only allow apps from the Managed Google Play Store.
On iOS, organizations can use Apple Business Manager and MDM to hide the native App Store and push a custom catalog of approved applications via a self-service portal, or restrict App Store access using supervised device restrictions.
A trusted source typically includes official app stores like the Apple App Store and Google Play Store, but for stricter compliance, it refers to a curated enterprise app catalog controlled by the organization.
Mobile Device Management (MDM) and Unified Endpoint Management (UEM) solutions provide the technical controls needed to deploy approved apps, block unsanctioned app stores, and audit devices for prohibited applications.
Auditors expect to see a documented list of approved applications or trusted sources, along with MDM configuration screenshots proving that users are blocked from downloading apps outside of these approved parameters. Tools like WatchDog Security's Compliance Center can centralize the approved list, attach MDM evidence, and maintain a time-stamped audit trail for reviews and changes.
Yes, if the organization uses containerization like Android Work Profiles or iOS User Enrollment. The allowlist policy applies strictly to the secure work container, allowing the user to install personal apps in their personal profile without accessing corporate data.
Organizations should implement a software request process where IT or security teams vet requested mobile apps for privacy policies, data handling, and known vulnerabilities before adding them to the trusted catalog.
Under CyberSecure Canada control 6.1.3.2(b), organizations must enforce policies ensuring employees only download mobile applications from an organizationally defined list of trusted sources.
App allowlisting fails most often when the approved list and trusted sources are undocumented, stale, or inconsistently communicated. Tools like WatchDog Security's Policy Management can maintain controlled versions of the approved apps/trusted sources policy with ownership, review cadence, and employee acknowledgement tracking, while WatchDog Security's Compliance Center can tie the policy and the approved list to CSC-06-008 and centralize audit evidence.
Exceptions should be treated as risk decisions: document the business need, vet the app (permissions, data handling, vendor reputation), define compensating controls, and set an expiry/review date. Tools like WatchDog Security's Risk Register can record the exception as a risk with treatment and approvals, and WatchDog Security's Compliance Center can link the exception record to CSC-06-008 evidence so auditors can see governance and time-bounded oversight.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-24 | WatchDog Security GRC Team | Initial publication |
