CM-10 is about using software legally and being able to prove it. It has three parts.
- Use software and its documentation in line with contract agreements and copyright law.
- Track the use of software and documentation covered by quantity licenses, so you control copying and distribution.
- Control and document the use of peer to peer file sharing, so it is not used to distribute, display, perform or reproduce copyrighted work without authorization.
800-53 binds US federal systems and reaches others by contract. For a small or mid size company it is a reference, and the questions behind it turn up in enterprise security reviews and in M and A diligence.
What it means in practice
NIST's guidance is brief. License tracking can be manual or automated, depending on what the organization needs, and contract agreements include software license agreements and non disclosure agreements. The control cares about three artifacts: what you are licensed for, what is actually in use, and how you stop unlicensed copying.
The enhancement CM-10.1, Open source Software, extends this to open source. For modern engineering teams that is where most of the license exposure sits, because one application can pull in hundreds of packages, each with its own license.
Evidence to collect
- A license inventory listing each commercial product, the quantity purchased and the term.
- Usage reports from admin consoles or license managers showing seats in use against seats owned.
- The policy on software acquisition and acceptable use, including peer to peer file sharing.
- Endpoint or network controls that block or restrict peer to peer clients, or the documented exceptions.
- An open source license report per product, with the approved license list and the review process for exceptions.
Common gaps
- Seat counts tracked in a spreadsheet nobody updates.
- Engineers install tools with team cards and the licenses never reach the register.
- No policy on copyleft licenses, so a strong copyleft dependency lands in a proprietary product.
- Peer to peer restrictions exist on paper, with nothing enforcing them.
- Open source license data is collected once for a deal and never refreshed.
How to implement it
Pull commercial licenses into one register with an owner per product. Compare seats owned against seats used every quarter. Write the open source rule down, which licenses are allowed, which need legal review and which are banned for your distribution model, and run the check in CI so a new dependency is evaluated when it is added.
An SBOM makes the open source side much easier, because it lists every component and version in one place. The demo below shows generating one.
Click through it at your own pace, or open it full screen.
Try it yourself
The free in-browser dependency scan at gold.safeguard.sh/scan lets you check the packages in a manifest against known vulnerabilities, which is a fast way to see how much open source sits in a project before you look at licenses.
Quick check
Why does CM-10 matter for open source packages?
Because the control covers use of software in line with contracts and copyright, and each open source package ships under a license with conditions. CM-10.1 addresses open source directly.
