What it covers. NIST guidance on application whitelisting, now usually called application allowlisting or application control. It explains how to allow only approved software to run, the attributes that can identify approved applications and how to plan and deploy the technology.
In practice. Applying it well means starting with high-value or stable systems such as servers, defining approval rules based on publisher signatures, paths or hashes, testing in audit mode and then enforcing. A process handles requests for new software and updates. Evidence includes allowlisting policies, deployment coverage and exception records.
Common gaps. Common gaps are rules so broad they allow most software, deployment stuck in audit mode and no process for routine updates that break rules. Allowlisting is also sometimes judged only on desktops, although it can be most effective on servers.