{"data":{"id":"CM-11","name":"User-installed Software","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Establish [Assignment: organization-defined policies] governing the installation of software by users;\nb. Enforce software installation policies through the following methods: [Assignment: organization-defined methods]; and\nc. Monitor policy compliance [Assignment: organization-defined frequency].","supplemental_guidance":"If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved \"app stores.\" Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.","enhancements":[{"id":"CM-11(01)","name":"Alerts for Unauthorized Installations","withdrawn":true,"incorporated_into":["CM-08(03)"]},{"id":"CM-11(02)","name":"Software Installation with Privileged Status","statement":"Allow user installation of software only with explicit privileged status.","baselines":[]},{"id":"CM-11(03)","name":"Automated Enforcement and Monitoring","statement":"Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-11","name":"User-installed Software","description":"a. Establish [Assignment: organization-defined policies] governing the installation of software by users;\nb. Enforce software installation policies through the following methods: [Assignment: organization-defined methods]; and\nc. Monitor policy compliance [Assignment: organization-defined frequency].","discussion":"If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved \"app stores.\" Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.","related_controls":["AC-03","AU-06","CM-02","CM-03","CM-05","CM-06","CM-07","CM-08","PL-04","SI-04","SI-07"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"No significant changes from Rev 4."}},"compliance_mappings":{"iso_27001_2022":["A.8.9","A.8.18","A.8.19"],"iso_27002_2022":["5.37","8.18","8.19"],"cobit_2019":["BAI10"],"pci_dss_v4":[],"nist_csf_2":["DE.CM-03","DE.CM-09","PR.PS-01","PR.PS-02","PR.PS-05"],"cis_controls_v8":["CIS 2","CIS 2.3","CIS 9.4"],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":["E8-1"],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":["5.37","8.18","8.19"],"rbi_csf":["Annex1.2"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"qatar_nia":["OS"],"uae_ia":["T7"],"bom_ctrm":["3.6","3.12"],"cbe_csf":["CTO-7"],"sa_js2":["JS2-8.4"],"bot_cyber":["Ch2.1","Ch2.6"],"eba_ict":["3.4.4"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.11","II.C.13(e)"],"sebi_cscrf":["PR.ES","PR.IP"],"cmmc_2":["CM"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":["MS8.4","MS8.10"],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":["UEM-02"],"csa_aicm":["UEM-02"],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict scripting engine and interpreter deployment to approved use cases prevent adversaries from leveraging user-installed scripting tools for execution."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting user ability to install software deployment tools prevents adversaries from leveraging user-installed management software for lateral tool distribution and execution."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Enforcing browser extension installation policies through approved extension lists prevents users from installing adversary-crafted browser extensions that serve as persistence mechanisms."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict installation sources to approved repositories and enforce integrity verification limit the impact of supply chain compromises on user endpoints."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting user ability to install applications limits the system binaries available for adversaries to abuse as proxy execution tools for bypassing application controls."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict server component installation to authorized change processes prevent adversaries from tricking users into installing malicious server plugins."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting user ability to install services and system-level software prevents adversaries from social engineering users into installing malicious system processes for persistence."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that prevent unauthorized service installation limit adversaries' ability to install and execute code through system service mechanisms."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting the installation of VNC and remote access software through installation policies prevents adversaries from deploying unauthorized remote control tools on endpoints."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict Python interpreter deployment prevent adversaries from leveraging user-installed Python environments for script-based attacks."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting development tool installation to approved sources and enforcing package signing verification limits the risk of compromised software dependencies reaching production systems."},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing software installation exclusively from trusted vendor channels and organizational app stores limits the impact of software supply chain compromises on managed endpoints."},{"id":"T1218.001","name":"Compiled HTML File","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict CHM file handler and HTML Help installation prevent adversaries from executing code through compiled HTML file abuse."},{"id":"T1218.002","name":"Control Panel","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting Control Panel applet installation prevents adversaries from deploying malicious CPL files that execute through the trusted Control Panel mechanism."},{"id":"T1218.003","name":"CMSTP","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting Connection Manager profile installation prevents adversaries from deploying malicious CMSTP profiles that bypass application whitelisting controls."},{"id":"T1218.004","name":"InstallUtil","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Software policies restricting .NET development tool installation on non-developer systems prevent adversaries from abusing InstallUtil for proxy execution."},{"id":"T1218.005","name":"Mshta","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting HTA file handling and mshta-dependent application installation limits the applications adversaries can leverage for HTML Application-based code execution."},{"id":"T1218.008","name":"Odbcconf","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting ODBC tool installation to only authorized database administration workstations prevents adversaries from abusing odbcconf for proxy execution on standard endpoints."},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting .NET framework tool installation prevents adversaries from leveraging Regsvcs and Regasm for COM component registration-based proxy execution."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict COM-dependent utility installation limit the tools adversaries can abuse for verclsid-based proxy execution."},{"id":"T1218.013","name":"Mavinject","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting development and debugging tool installation prevents adversaries from using user-installed instances of mavinject for process injection attacks."},{"id":"T1218.014","name":"MMC","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting MMC snap-in installation and management console deployment limits the administrative tools adversaries can abuse for MMC-based proxy execution."},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict database extension installation prevent adversaries from deploying malicious SQL stored procedures through unauthorized database modifications."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting Exchange server component installation to authorized change management processes prevents installation of malicious Transport Agents for mail interception."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Software policies restricting IIS module installation prevent adversaries from deploying malicious web server components through unauthorized software installation."},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Launch Agent installation on macOS through software policies prevents users from installing applications that register persistent agents for adversary exploitation."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict systemd service creation prevent adversaries from installing applications that register persistent systemd services on Linux systems."},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Windows service installation through software policies prevents adversaries from deploying applications that install malicious Windows services for persistence."},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Software policies restricting Launch Daemon installation on macOS prevent users from installing applications that register root-level persistent daemons."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting software installation that creates XDG autostart entries prevents adversaries from deploying applications that auto-launch on Linux desktop login."},{"id":"T1550.001","name":"Application Access Token","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies that restrict OAuth application registration and third-party app installation limit the applications adversaries can leverage for token-based access."},{"id":"T1564.009","name":"Resource Forking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting software installation that uses resource forks and extended attributes prevents adversaries from deploying applications that hide malicious payloads in macOS resource forks."},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Software installation policies on macOS that restrict launchctl-dependent service installation prevent adversaries from deploying services executed through the launchd system."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings from framework-coverage data 2026-10-03: nist_csf_2 DE.CM-03, DE.CM-09, PR.PS-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-046"]}}