SA-7, User-installed Software, is withdrawn in NIST SP 800-53 Rev 5. The catalog shows it incorporated into CM-11, User-Installed Software, and SI-7, Software, Firmware, and Information Integrity.
800-53 binds US federal systems, and others through contract. It is a reference for the rest.
What it means in practice
Users installing whatever they like on company machines is a well known source of risk. Under CM-11 you set rules for what users may install and monitor for compliance. SI-7 covers integrity of software once it is installed.
Evidence to collect
- A written policy on who may install software and how exceptions work.
- An endpoint inventory showing installed applications.
- Alerts or reports for unapproved installs.
Common gaps
A policy that says no, with admin rights handed out to everyone anyway.
How to implement it
Remove local admin by default, publish an approved software catalog, and review exceptions monthly. Drop SA-7 from documents and cite CM-11.
A small worked example
An employee installs a free file converter that bundles adware, on a laptop with access to customer exports. With no local admin rights and an approved software catalog, the install fails and a request goes to IT. Keep the catalog, the exception tickets and a monthly report of unapproved software found.
Quick check
Is SA-7 still a live control?
No. It was withdrawn and incorporated into CM-11 and SI-7.
