NIST 800-53 Rev 5
424 controls available
CM-11lowmoderatehigh
User-installed Software
Configuration Management
Control Statement
Establish {{ insert: param, cm-11_odp.01 }} governing the installation of software by users; Enforce software installation policies through the following methods: {{ insert: param, cm-11_odp.02 }} ; and Monitor policy compliance {{ insert: param, cm-11_odp.03 }}.
Discussion
If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.
- Framework
- NIST SP 800-53 Rev 5
- Family
- Configuration Management
- Baselines
- low, moderate, high
Related Frameworks
13 paths across 3 frameworks
Related Frameworks
SCF2 mappings
NIST 800-1711 mapping
3.4.9
1.00
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI8 mappings
CCI-001804
1.00
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001805
1.00
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001806
1.00
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001807
1.00
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001808
1.00
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001809
1.00
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001812
0.25
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-003980
0.25
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
Related STIGs
78 STIGs reach this control through 11 CCIs. Expand a row to see the responsible NICE and O*NET roles.
Operating System - Desktop
7 STIGs
Operating System - Desktop
7 STIGsMicrosoft Windows 10 Security Technical Implementation Guide
32025-02-252 of 261 findings match
H1M1
Microsoft Windows 11 Security Technical Implementation Guide
22025-05-152 of 258 findings match
H1M1
Microsoft Windows 11 Security Technical Implementation Guide
V2R72026-02-122 of 262 findings match
H1M1
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
22024-12-041 of 155 findings match
M1
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
12025-05-051 of 161 findings match
M1
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V1R72026-02-061 of 160 findings match
M1
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V1R22026-02-111 of 160 findings match
M1
Operating System - Server
10 STIGs
Operating System - Server
10 STIGsMicrosoft Windows Server 2019 Security Technical Implementation Guide
32025-05-232 of 275 findings match
H1M1
Microsoft Windows Server 2019 Security Technical Implementation Guide
V3R82026-02-122 of 282 findings match
H1M1
Microsoft Windows Server 2022 Security Technical Implementation Guide
22025-05-152 of 275 findings match
H1M1
Microsoft Windows Server 2022 Security Technical Implementation Guide
V2R82026-02-132 of 282 findings match
H1M1
Microsoft Windows Server 2025 Security Technical Implementation Guide
V1R12026-02-202 of 284 findings match
H1M1
Anduril NixOS Security Technical Implementation Guide
12024-10-251 of 104 findings match
M1
Anduril NixOS Security Technical Implementation Guide
V1R22025-08-191 of 103 findings match
M1
General Purpose Operating System Security Requirements Guide
32024-12-041 of 198 findings match
M1
Show 2 more STIGs in this category →Hide additional STIGs
General Purpose Operating System Security Requirements Guide
V3R32025-09-221 of 203 findings match
M1
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V1R12026-03-111 of 434 findings match
M1
Operating System - Mainframe
3 STIGs
Operating System - Mainframe
3 STIGsIBM zVM Using CA VM:Secure Security Technical Implementation Guide
V2R22022-08-311 of 77 findings match
M1
Mainframe Product Security Requirements Guide
32024-12-051 of 193 findings match
M1
Mainframe Product Security Requirements Guide
V3R42025-09-101 of 194 findings match
M1
Network Device
9 STIGs
Network Device
9 STIGsFortinet FortiGate Firewall NDM Security Technical Implementation Guide
12023-06-011 of 60 findings match
M1
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide
V1R52025-11-191 of 60 findings match
M1
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
22025-03-071 of 56 findings match
M1
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V2R42025-12-101 of 56 findings match
M1
Juniper Router NDM Security Technical Implementation Guide
V3R22024-12-051 of 49 findings match
M1
Juniper SRX Services Gateway NDM Security Technical Implementation Guide
V3R32024-12-201 of 68 findings match
M1
Network Device Management Security Requirements Guide
V5R32025-02-111 of 104 findings match
M1
Network Device Management Security Requirements Guide
V5R42025-09-101 of 105 findings match
M1
Show 1 more STIG in this category →Hide additional STIGs
SDN Controller Security Requirements Guide
22024-05-281 of 34 findings match
M1
Database
16 STIGs
Database
16 STIGsCrunchy Data Postgres 16 Security Technical Implementation Guide
12024-06-171 of 111 findings match
M1
Crunchy Data Postgres 16 Security Technical Implementation Guide
V1R22026-02-271 of 111 findings match
M1
Crunchy Data PostgreSQL Security Technical Implementation Guide
V3R12024-08-271 of 113 findings match
M1
Database Security Requirements Guide
42024-12-041 of 142 findings match
M1
Database Security Requirements Guide
V4R52026-02-261 of 142 findings match
M1
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V2R12024-08-271 of 118 findings match
M1
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V2R12023-06-111 of 93 findings match
M1
MariaDB Enterprise 10.x Security Technical Implementation Guide
22024-12-051 of 110 findings match
M1
Show 8 more STIGs in this category →Hide additional STIGs
MariaDB Enterprise 10.x Security Technical Implementation Guide
V2R52026-03-021 of 107 findings match
M1
Microsoft Azure SQL Database Security Technical Implementation Guide
V2R32025-06-111 of 76 findings match
M1
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V1R12025-10-071 of 84 findings match
M1
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V1R12024-09-271 of 50 findings match
M1
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V1R12026-02-201 of 55 findings match
M1
MS SQL Server 2016 Database Security Technical Implementation Guide
32025-06-111 of 28 findings match
M1
Oracle MySQL 8.0 Security Technical Implementation Guide
V2R22024-09-041 of 100 findings match
M1
Redis Enterprise 6.x Security Technical Implementation Guide
V2R22024-09-041 of 71 findings match
M1
Web / Application Server
6 STIGs
Web / Application Server
6 STIGsApplication Security and Development Security Technical Implementation Guide
62025-02-121 of 286 findings match
M1
Application Security and Development Security Technical Implementation Guide
V6R42025-09-091 of 286 findings match
M1
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V2R62024-12-061 of 68 findings match
M1
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V2R62023-12-181 of 64 findings match
M1
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V2R22024-12-061 of 68 findings match
M1
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V2R32025-05-141 of 66 findings match
M1
Virtualization / Container
6 STIGs
Virtualization / Container
6 STIGsContainer Platform Security Requirements Guide
22025-05-153 of 187 findings match
H1M2
Container Platform Security Requirements Guide
V2R42025-09-103 of 188 findings match
H1M2
Rancher Government Solutions RKE2 Security Technical Implementation Guide
22024-12-201 of 24 findings match
M1
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V2R62026-02-131 of 21 findings match
M1
Virtual Machine Manager Security Requirements Guide
22024-12-061 of 193 findings match
M1
Virtual Machine Manager Security Requirements Guide
V2R32025-09-101 of 198 findings match
M1
Endpoint Security Management
5 STIGs
Endpoint Security Management
5 STIGsUnified Endpoint Management Server Security Requirements Guide
22024-12-092 of 137 findings match
M2
Unified Endpoint Management Server Security Requirements Guide
V2R42025-09-102 of 138 findings match
M2
Forescout Network Device Management Security Technical Implementation Guide
V2R32025-06-121 of 42 findings match
M1
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V2R22025-02-111 of 75 findings match
M1
Tanium 7.x Security Technical Implementation Guide
V2R32025-05-141 of 98 findings match
M1
Productivity Application
2 STIGs
Productivity Application
2 STIGsMicrosoft Edge Security Technical Implementation Guide
22025-05-151 of 59 findings match
L1
Microsoft Edge Security Technical Implementation Guide
V2R52026-02-251 of 61 findings match
L1
Uncategorized
14 STIGs
Uncategorized
14 STIGsMicrosoft Windows 11 Security Technical Implementation Guide
V2R82026-05-192 of 256 findings match
H1M1
Microsoft Windows Server 2022 Security Technical Implementation Guide
V2R92026-05-192 of 279 findings match
H1M1
Microsoft Windows Server 2025 Security Technical Implementation Guide
V1R22026-05-282 of 292 findings match
H1M1
Unified Endpoint Management Server Security Requirements Guide
V2R52026-06-112 of 137 findings match
M2
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V1R32026-05-231 of 160 findings match
M1
Crunchy Data Postgres 16 Security Technical Implementation Guide
V1R32026-06-081 of 111 findings match
M1
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V2R22026-05-231 of 93 findings match
M1
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V2R52026-06-151 of 55 findings match
M1
Show 6 more STIGs in this category →Hide additional STIGs
Mainframe Product Security Requirements Guide
V3R52026-05-231 of 194 findings match
M1
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V1R22026-05-231 of 51 findings match
M1
Network Device Management Security Requirements Guide
V5R52026-05-231 of 99 findings match
M1
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V2R72026-05-131 of 21 findings match
M1
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V1R22026-05-141 of 434 findings match
M1
Virtual Machine Manager Security Requirements Guide
V2R42026-06-291 of 198 findings match
M1