use icacls to apply read and execute permissions for "This folder, subfolder and files" (e.g. for IIS7 App Pool Isolation)

icacls C:\inetpub\wwwroot\mysite\ /grant:r "IIS APPPOOL\mywebsitepool":(OI)(CI)(RX)

guarantees that new files & directories put into this folder inherit the permissions that were set for the parent folder.

 More details on IIS7 Application pool isolation can be found here: