CM-11

Requirement
1. Establish [Assignment: organization-defined policies] governing the installation of software by users;
2. Enforce software installation policies through the following methods: [Assignment: organization-defined methods]; and
3. Monitor policy compliance [Assignment: organization-defined frequency].

Discussion

If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved app stores. Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing user-installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; list of rules governing user installed software; system monitoring records; system audit records; continuous monitoring strategy; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for governing user-installed software; organizational personnel operating, using, and/or maintaining the system; organizational personnel monitoring compliance with user-installed software policy; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes governing user-installed software on the system; mechanisms enforcing policies and methods for governing the installation of software by users; mechanisms monitoring policy compliance].

ID	Assessment Objectives
CM-11a.	<CM-11_ODP[01] policies> governing the installation of software by users are established;
CM-11b.	software installation policies are enforced through <CM-11_ODP[02] methods>;
CM-11c.	compliance with <CM-11_ODP[01] policies> is monitored <CM-11_ODP[03] frequency>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!