ComplianceNIST 800-53 enhancement
NIST-CM-7(4) Unauthorized Software — Deny-by-exception
- Framework
- NIST SP 800-53 rev5 (5.2.0)
- Family
- CM Configuration Management
- Control
- CM-7(4)
Control statement
(a) Identify [Assignment: software programs];
(b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and
(c) Review and update the list of unauthorized software programs [Assignment: frequency].
Discussion
Unauthorized software programs can be limited to specific versions or from a specific source. The concept of prohibiting the execution of unauthorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses.
Related
Enhancement of · Compliance (1)
- NIST-CM-7 Least Functionality NIST 800-53 control
Related control · Compliance (5)
- NIST-CM-10 Software Usage Restrictions NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-CM-8 System Component Inventory NIST 800-53 control
- NIST-PL-9 Central Management NIST 800-53 control
- NIST-PM-5 System Inventory NIST 800-53 control