SA-6, Software Usage Restrictions, is withdrawn in NIST SP 800-53 Rev 5. The catalog shows it incorporated into CM-10, Software Usage Restrictions, and SI-7, Software, Firmware, and Information Integrity.
800-53 binds US federal systems, and others through contract. Everyone else can use it as a reference.
What it means in practice
Two ideas live in the old control. First, use software within its license terms. Second, protect the integrity of what you run. Today you show the first under CM-10 and the second under SI-7.
Evidence to collect
- A software inventory with license terms for what you run and ship.
- A policy on permitted licenses for dependencies.
- Integrity checks on installed software.
Common gaps
Tracking commercial licenses but ignoring the open source licenses in transitive dependencies.
How to implement it
Scan dependencies for license data, set an allow list, and record exceptions with an owner. Update any document that still cites SA-6.
A small worked example
A team ships a product that bundles forty open source libraries. One carries a license that forbids a use the company relies on. A license scan at build time would have caught it before release. Keep the scan output, the allow list and the exception log, and you have the evidence an auditor will ask for.
Quick check
Where do software usage restrictions live in Rev 5?
In CM-10, with integrity aspects in SI-7.
