CM-10 Software Usage Restrictions

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	1 (0 in a baseline)

Related controls: AC-17, AU-6, CM-7, CM-8, PM-30, SC-7

Control statement

• a. Use software and associated documentation in accordance with contract agreements and copyright laws;
• b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
• c. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

NIST discussion

Software license tracking can be accomplished by manual or automated methods, depending on organizational needs. Examples of contract agreements include software license agreements and non-disclosure agreements.

Control enhancements

CM-10(1) Open-source Software

Baselines: Not in a baseline

Establish the following restrictions on the use of open-source software: [Assignment: organization-defined restrictions].

Discussion and assessment objectives for CM-10(1)

Open-source software refers to software that is available in source code form. Certain software rights normally reserved for copyright holders are routinely provided under software license agreements that permit individuals to study, change, and improve the software. From a security perspective, the major advantage of open-source software is that it provides organizations with the ability to examine the source code. In some cases, there is an online community associated with the software that inspects, tests, updates, and reports on issues found in software on an ongoing basis. However, remediating vulnerabilities in open-source software may be problematic. There may also be licensing issues associated with open-source software, including the constraints on derivative use of such software. Open-source software that is available only in binary form may increase the level of risk in using such software.

Determine if [Assignment: organization-defined restrictions] are established for the use of open-source software.

Examine: Configuration management policy; software usage restrictions; software contract agreements and copyright laws; site license documentation; list of software usage restrictions; software license tracking reports; configuration management plan; system security plan; system security plan; other relevant documents or records.

Interview: Organizational personnel operating, using, and/or maintaining the system; organizational personnel with software license management responsibilities; organizational personnel with information security responsibilities; system/network administrators.

Test: Organizational processes for tracking the use of software protected by quantity licenses; organizational processes for controlling/documenting the use of peer-to-peer file sharing technology; mechanisms implementing software license tracking; mechanisms implementing and controlling the use of peer-to-peer files sharing technology.

Assessment objectives (SP 800-53A)

Objectives and methods for CM-10

Determine if:

• CM-10a. software and associated documentation are used in accordance with contract agreements and copyright laws;
• CM-10b. the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution;
• CM-10c. the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Examine: Configuration management policy; software usage restrictions; software contract agreements and copyright laws; site license documentation; list of software usage restrictions; software license tracking reports; configuration management plan; system security plan; system security plan; other relevant documents or records.

Interview: Organizational personnel operating, using, and/or maintaining the system; organizational personnel with software license management responsibilities; organizational personnel with information security responsibilities; system/network administrators.

Test: Organizational processes for tracking the use of software protected by quantity licenses; organizational processes for controlling/documenting the use of peer-to-peer file sharing technology; mechanisms implementing software license tracking; mechanisms implementing and controlling the use of peer-to-peer files sharing technology.

Policy statement

• Users shall use software and its documentation in accordance with contract agreements and copyright laws. (CM-10a)
• The System owner shall track the use of software and documentation protected by quantity licenses to control copying and distribution. (CM-10b)
• The System owner shall control and document the use of peer-to-peer file sharing technology so that it is not used for unauthorized distribution, display, performance or reproduction of copyrighted work. (CM-10c)

From the Configuration Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

CM-10 asks you to use software and its documentation as licenses and copyright law allow, to track quantity-licensed software so it is not copied beyond the license, and to control peer-to-peer file sharing so it is not used to share copyrighted work without permission. NIST’s CM-10 discussion says tracking can be manual or automated, and gives software license agreements and non-disclosure agreements as examples of the contract agreements that apply.

Common implementations.

• A software asset management tool, or the endpoint management tool, that compares installed copies and assigned subscriptions with the licenses owned
• License counts for cloud and subscription software taken from the provider’s admin console, since those seats are licenses too
• Installation limited to software from the approved catalog, which keeps license tracking accurate (CM-11)
• Peer-to-peer file sharing applications blocked on endpoints and at the network boundary, with any business use approved and recorded as an exception
• Users told of their obligations through security awareness training or the Rules of Behavior

Organization-defined parameters. CM-10 has none. In the Configuration Management policy, users follow license terms and copyright law, and the system owner tracks quantity licenses and controls peer-to-peer file sharing.

Evidence assessors ask for.

• A license reconciliation for a sample of products: licenses owned against copies installed or seats assigned
• The software asset management reports or procedure behind it
• The settings that block peer-to-peer file sharing, and any approved exceptions
• Evidence that users are told of their obligations

Inheritance. Software asset management and peer-to-peer blocking at the boundary are usually common controls. The system owns tracking the licenses for software it runs, so CM-10 is usually a hybrid control.

Common findings.

• More copies installed, or more users assigned, than licenses owned.
• License tracking that covers desktop software but not servers, cloud subscriptions or developer tools.
• Peer-to-peer clients found on endpoints with no approved exception.
• No one named to reconcile licenses, so it happens only when a vendor audits.

Enhancements in the Moderate baseline. None. CM-10(1) open-source software, which sets restrictions on the use of open-source software, is in no baseline. NIST’s discussion of it notes that open-source software can be inspected but may be hard to remediate, and may carry license constraints on derivative use.

Artifacts

• Configuration Management Decision Worksheet
• Configuration Management Policy