CM-11 deals with software that users install themselves. The statement has three parts. Establish policies governing the installation of software by users. Enforce those policies using methods you choose. Monitor compliance at a frequency you choose.
800-53 binds US federal systems and others by contract. For everyone else it is a reference, and endpoint management questions in customer reviews map closely to it.
What it means in practice
NIST's guidance starts from a simple fact. If users have the privileges, they can install software. So you decide what is permitted and what is prohibited. Permitted installs include updates and security patches to existing software and new applications from approved app stores. Prohibited installs include software with unknown or suspect pedigrees, or software the organization considers potentially malicious.
Policy can be your own or come from an outside source. Enforcement can be procedural, such as an approval request, or automated, such as application allow lists and removal of local admin rights.
Evidence to collect
- The written policy on software installation, with approved sources named.
- Endpoint management configuration showing how installs are restricted, for example standard users without admin rights.
- The approved software catalog or app store list.
- Monitoring output, such as a report of installed software against the catalog.
- Exception records with approver and expiry date.
Common gaps
- Developers run as local admins with no compensating control, and the policy does not mention them.
- The approved list exists, but nothing compares installed software to it.
- Browser extensions and package manager installs are outside the policy.
- Exceptions never expire.
How to implement it
Remove local admin by default, then grant elevation by request with a time limit. Publish an approved catalog and a quick path to add to it, because a slow process drives workarounds. Run a periodic inventory comparison and ticket the differences.
Three enhancements raise the bar. CM-11.1 covers Alerts for Unauthorized Installations, CM-11.2 covers Software Installation with Privileged Status, and CM-11.3 covers Automated Enforcement and Monitoring.
Quick check
Is a signed acceptable use policy enough for CM-11?
Usually not on its own. The control also asks you to enforce the policy and monitor compliance, so you need technical or procedural enforcement plus monitoring records.
