CM-11 User-installed Software
Guidance: draftPolicy clause: draftWhat these mean
cm11ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Low, Moderate, High | Organization | 2 (0 in a baseline) |
Related controls: AC-3, AU-6, CM-2, CM-3, CM-5, CM-6, CM-7, CM-8, PL-4, SI-4, SI-7
Control statement
Section titled “Control statement”- a. Establish [Assignment: organization-defined policies] governing the installation of software by users;
- b. Enforce software installation policies through the following methods: [Assignment: organization-defined methods] ; and
- c. Monitor policy compliance [Assignment: organization-defined frequency].
NIST discussion
If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved “app stores.” Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.
Control enhancements
Section titled “Control enhancements”CM-11(2) Software Installation with Privileged Status
Section titled “CM-11(2) Software Installation with Privileged Status”Baselines: Not in a baseline
Allow user installation of software only with explicit privileged status.
Discussion and assessment objectives for CM-11(2)
Privileged status can be obtained, for example, by serving in the role of system administrator.
Determine if user installation of software is allowed only with explicit privileged status.
Examine: Configuration management policy; procedures addressing user-installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; alerts/notifications of unauthorized software installations; system audit records; continuous monitoring strategy; system security plan; other relevant documents or records.
Interview: Organizational personnel with responsibilities for governing user-installed software; organizational personnel operating, using, and/or maintaining the system; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes governing user-installed software on the system; mechanisms for prohibiting installation of software without privileged status (e.g., access controls).
CM-11(3) Automated Enforcement and Monitoring
Section titled “CM-11(3) Automated Enforcement and Monitoring”Baselines: Not in a baseline
Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms].
Discussion and assessment objectives for CM-11(3)
Organizations enforce and monitor compliance with software installation policies using automated mechanisms to more quickly detect and respond to unauthorized software installation which can be an indicator of an internal or external hostile attack.
Determine if:
- CM-11(03)[01] compliance with software installation policies is enforced using [Assignment: organization-defined automated mechanisms];
- CM-11(03)[02] compliance with software installation policies is monitored using [Assignment: organization-defined automated mechanisms].
Examine: Configuration management policy; procedures addressing user-installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; list of rules governing user installed software; system monitoring records; system audit records; continuous monitoring strategy; system security plan; other relevant documents or records.
Interview: Organizational personnel with responsibilities for governing user-installed software; organizational personnel operating, using, and/or maintaining the system; organizational personnel monitoring compliance with user-installed software policy; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes governing user-installed software on the system; automated mechanisms enforcing policies on installation of software by users; automated mechanisms monitoring policy compliance.
Withdrawn enhancements: CM-11(1).
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for CM-11
Determine if:
- CM-11a. [Assignment: organization-defined policies] governing the installation of software by users are established;
- CM-11b. software installation policies are enforced through [Assignment: organization-defined methods];
- CM-11c. compliance with [Assignment: organization-defined policies] is monitored [Assignment: organization-defined frequency].
Examine: Configuration management policy; procedures addressing user-installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; list of rules governing user installed software; system monitoring records; system audit records; continuous monitoring strategy; system security plan; other relevant documents or records.
Interview: Organizational personnel with responsibilities for governing user-installed software; organizational personnel operating, using, and/or maintaining the system; organizational personnel monitoring compliance with user-installed software policy; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes governing user-installed software on the system; mechanisms enforcing policies and methods for governing the installation of software by users; mechanisms monitoring policy compliance.
Policy statement
- The Chief Information Security Officer shall establish the following rules for software installation by users: Fill in: policies governing the installation of software by users Typical: users may install only software from the organization’s approved software catalog; all other installation requires approval by the system owner. (CM-11a)
- The System owner shall enforce those rules through Fill in: methods used to enforce software installation policies Typical: removing local administrator rights and using an application allow list. (CM-11b)
- The System owner shall monitor compliance with those rules Fill in: frequency with which to monitor compliance Typical: at least monthly. (CM-11c)
From the Configuration Management Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”CM-11 asks you to set rules for what software users may install, enforce them and check compliance on a schedule. NIST’s CM-11 discussion gives updates and security patches to existing software, and applications from organization-approved “app stores”, as examples of permitted installation, and software with unknown or suspect pedigree, or that the organization considers potentially malicious, as examples of prohibited installation. Enforcement can be procedural, automated or both.
Common implementations. A self-service software catalog, such as a company portal or managed app store, with the software the organization has approved. Users have no local administrator rights, so they cannot install anything else, and an application allow list blocks software that arrives by other routes, such as portable programs that need no installation. Requests for software outside the catalog go to the system owner, and approved software is added to the catalog. The Rules of Behavior tell users not to install software, browser extensions or services the organization has not approved. The allow list is the same mechanism that meets CM-7(2) and CM-7(5). NIST’s guide to allow listing, SP 800-167, Guide to Application Whitelisting (October 2015, final, no newer revision as of September 2026), describes the approaches.
Organization-defined parameters. Typical values, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Rules for software installation by users (a) | Users may install only software from the organization’s approved software catalog; all other installation requires approval by the system owner |
| Enforcement methods (b) | Removing local administrator rights and using an application allow list |
| How often compliance is monitored (c) | At least monthly |
In the Configuration Management policy, the Chief Information Security Officer sets the rules, and the system owner enforces them and monitors compliance.
Evidence assessors ask for.
- The written rules for user-installed software
- The list of users with local administrator rights, and the approval for each
- The application allow list settings, showing enforcement rather than audit mode
- Monthly compliance reports comparing installed software with the approved catalog, and the follow-up on anything found
- Approved requests for software outside the catalog
Inheritance. Endpoint management, the software catalog and allow listing are usually common controls. The system owns the rules for its own servers and applications, such as who may install plug-ins or extensions, so CM-11 is usually a hybrid control.
Common findings.
- Many users with local administrator rights “temporarily”, with no end date.
- Browser extensions and developer tools left out of the rules.
- An allow list running in audit mode only.
- Compliance reports produced but not reviewed, so unapproved software stays installed.
Enhancements in the Moderate baseline. None, and none in High. CM-11(2) software installation with privileged status and CM-11(3) automated enforcement and monitoring are in no baseline, though the typical enforcement methods above meet much of both.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.