# SA-07 User-installed Software

NIST SP 800-53 control. Family: SA System and Services Acquisition. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.
Withdrawn from SP 800-53 by NIST. Its content moved into CM-11, SI-07.

Statement: The organization enforces explicit rules governing the installation of software by users.
Guidance: If provided the necessary privileges, users have the ability to install software. The organization identifies what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software that is free only for personal, not government use, and software whose pedigree with regard to being potentially malicious is unknown or suspect).

## Patterns that use it (3)
- Critical (1): SP-024 iPhone Pattern
- Important (1): SP-001 Client Module
- Standard (1): SP-025 Advanced Monitoring and Detection

## Clauses by framework (6 frameworks)
- iso_42001_2023: A.4.4, A.9.4
- anssi: Hygiene.20, SecNumCloud.13.1
- osfi_b13: B-13.2.2, B-13.3.2
- finma_circular: IV.A(36), IV.C(64)
- gdpr: Art.25(1)
- dora: Art.9(4)(e)

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SA-07
- Clauses only: /api/v1/controls/SA-07?fields=mappings
- Page for people: /controls/sa-07/