ComplianceNIST 800-53 control

NIST-CM-10 Software Usage Restrictions

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
CM Configuration Management
Control
CM-10
ATT&CK techniques mitigated
9

Control statement

a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and c. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Discussion

Software license tracking can be accomplished by manual or automated methods, depending on organizational needs. Examples of contract agreements include software license agreements and non-disclosure agreements.

ATT&CK mappings (CTID)

• T1546.008 Accessibility Features • T1546.013 PowerShell Profile • T1550.001 Application Access Token • T1553 Subvert Trust Controls • T1553.004 Install Root Certificate • T1559 Inter-Process Communication • T1559.002 Dynamic Data Exchange • T1562.006 Indicator Blocking • T1562.009 Safe Mode Boot

Related

Mitigates · not in database (2)

Mitigates · MITRE ATT&CK (7)

  • T1553.004 Install Root Certificate sub-technique
  • T1559 Inter-Process Communication technique
  • T1559.002 Dynamic Data Exchange sub-technique
  • T1553 Subvert Trust Controls technique
  • T1550.001 Application Access Token sub-technique
  • T1546.008 Accessibility Features sub-technique
  • T1546.013 PowerShell Profile sub-technique

Related control · Compliance (6)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-PM-30 Supply Chain Risk Management Strategy NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control

Referenced by Compliance · enhancement of (1)

Referenced by Compliance · has member (1)

  • NIST-CM Configuration Management NIST 800-53 family

Referenced by Compliance · related control (8)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-CM-7(4) Unauthorized Software — Deny-by-exception NIST 800-53 enhancement
  • NIST-CM-7(5) Authorized Software — Allow-by-exception NIST 800-53 enhancement
  • NIST-CM-7(7) Code Execution in Protected Environments NIST 800-53 enhancement
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-PM-30 Supply Chain Risk Management Strategy NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control