CM-11 CM · Configuration Management

User-installed Software

✓ LOW ✓ MODERATE ✓ HIGH
2 Enhancements 1 Overlay 11 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.

Enhancements NIST SOURCE

CM-11(1) Alerts for Unauthorized Installations WITHDRAWN

Withdrawn. Incorporated into CM-8(3).

CM-11(2) Software Installation with Privileged Status LOW MODERATE HIGH

Allow user installation of software only with explicit privileged status.

Discussion

Privileged status can be obtained, for example, by serving in the role of system administrator.

Open full page for CM-11(2) →
CM-11(3) Automated Enforcement and Monitoring LOW MODERATE HIGH

Enforce and monitor compliance with software installation policies using [organization-defined automated mechanisms].

Discussion

Organizations enforce and monitor compliance with software installation policies using automated mechanisms to more quickly detect and respond to unauthorized software installation which can be an indicator of an internal or external hostile attack.

Open full page for CM-11(3) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for CM-11 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. policies governing the installation of software by users are defined;
  2. methods used to enforce software installation policies are defined;
  3. frequency with which to monitor compliance is defined;
  4. <CM-11_ODP[01] policies> governing the installation of software by users are established;
  5. software installation policies are enforced through <CM-11_ODP[02] methods>;
  6. compliance with <CM-11_ODP[01] policies> is monitored <CM-11_ODP[03] frequency>.

Examine

[SELECT FROM: Configuration management policy; procedures addressing user-installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; list of rules governing user installed software; system monitoring records; system audit records; continuous monitoring strategy; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for governing user-installed software; organizational personnel operating, using, and/or maintaining the system; organizational personnel monitoring compliance with user-installed software policy; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes governing user-installed software on the system; mechanisms enforcing policies and methods for governing the installation of software by users; mechanisms monitoring policy compliance].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for CM-11. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • system security plan
  • continuous monitoring strategy

Configuration

  • Configuration management policy
  • configuration management plan
  • system design documentation
  • system configuration settings and associated documentation

Testing

  • Organizational processes governing user-installed software on the system
  • mechanisms enforcing policies and methods for governing the installation of software by users
  • mechanisms monitoring policy compliance

Other Records

  • procedures addressing user-installed software
  • list of rules governing user installed software
  • system monitoring records
  • system audit records
  • other relevant documents or records