CIS Control 2 aims to actively manage all software so only authorized software is installed and can execute. Evidence includes a software inventory, an authorization list, and records that unauthorized software is found and blocked. SBOMs and registry listings cover application components, while endpoint tools cover installed programs.
What the control says
The Center for Internet Security describes Control 2, "Inventory and Control of Software Assets", as actively managing, inventorying, tracking and correcting all software, operating systems and applications on the network, so that only authorized software is installed and can execute, and unauthorized or unmanaged software is found and prevented from installation or execution. It appears in the 18 controls of CIS Controls v8.1.
Notice three verbs: inventory, authorize, enforce. Each needs its own evidence.
Evidence per verb
| Verb | Artifact |
|---|---|
| Inventory | Dated list of software with version and owner; per release SBOMs for what you ship |
| Authorize | Approved software list, approved base images, dependency policy |
| Enforce | Block rules in registries or deploy gates; reports of blocked installs |
| Correct | Tickets showing unmanaged software removed or approved |
There are two software populations. One is what your staff install on devices. The other is what your builds pull into production. CIS Control 2 covers both in spirit, so assemble evidence for each.
Steps for engineering teams
- Generate SBOMs for every release and store them.
- Keep an approved list of base images and runtime versions.
- Route package installs through a controlled registry or policy check.
- Review new direct dependencies in pull requests and log the approval.
- Export running image digests monthly and compare with the approved list. Investigate unknowns.
- Track end of life components and set retirement dates.
For developer devices, an endpoint management export of installed applications covers the other population, if your organization uses one.
Where gaps hide
Build tools and plugins that never appear in an inventory. Containers pulled directly from public registries by a developer for a test that became permanent. Browser extensions and editor extensions. Vendored copies of libraries inside source trees that scanners miss.
When you find these, add them to the list and record the decision. That finding-and-fixing story is the evidence the control is alive.
Try it yourself
Click through the dependency inventory demo to see components listed with versions and sources, the starting point for the inventory half of Control 2.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard can produce SBOM and dependency scanning results and run asset discovery, which gives you machine generated inventory records to attach next to your own review notes. You can try the free scan at gold.safeguard.sh/scan. Whether a record satisfies a control is for you and your auditor to decide.
Quick check
Does Control 2 require an allowlist?
CIS describes authorized software being the only software that can execute. An allowlist is one way to implement that, and your implementation choice is yours to document.
Is an SBOM a software inventory?
It is an inventory of components inside one product. A full software inventory also covers operating systems and applications on your systems.
Sources
- CIS Control 2: Inventory and Control of Software Assets, Center for Internet Security
- CIS Controls list, Center for Internet Security
- CIS Controls v8.1, Center for Internet Security
Last reviewed: 19 October 2026.
