use icacls to apply read and execute permissions for "This folder, subfolder and files" (e.g. for IIS7 App Pool Isolation)
icacls C:\inetpub\wwwroot\mysite\ /grant:r "IIS APPPOOL\mywebsitepool":(OI)(CI)(RX)
guarantees that new files & directories put into this folder inherit the permissions that were set for the parent folder.
More details on IIS7 Application pool isolation can be found here: