CM-10

CM-10 SOFTWARE USAGE RESTRICTIONS

Overview

Number	Title	Impact	Priority	Subject Area
CM-10	Software Usage Restrictions	LOW	P2	Configuration Management

Instructions
The organization: CM-10a. Uses software and associated documentation in accordance with contract agreements and copyright laws; CM-10b. Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and CM-10c. Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Instructions

The organization:

CM-10a.

Uses software and associated documentation in accordance with contract agreements and copyright laws;

CM-10b.

Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

CM-10c.

Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Guidance
Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.

Enhancements

CM-10 (1) Open Source Software

Open source software refers to software that is available in source code form. Certain software rights normally reserved for copyright holders are routinely provided under software license agreements that permit individuals to study, change, and improve the software. From a security perspective, the major advantage of open source software is that it provides organizations with the ability to examine the source code. However, there are also various licensing issues associated with open source software including, for example, the constraints on derivative use of such software.

The organization establishes the following restrictions on the use of open source software: Assignment: organization-defined restrictions.