Navigate

CCI-001806

CCI-001806 Definition

Defines methods to be employed to enforce the software installation policies.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if software installation policies are enforced through [CM-11_ODP[02]; methods used to enforce software installation policies are defined].

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing user-installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; list of rules governing user installed software; system monitoring records; system audit records; continuous monitoring strategy; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for governing user-installed software; organizational personnel operating, using, and/or maintaining the system; organizational personnel monitoring compliance with user-installed software policy; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes governing user-installed software on the system; mechanisms enforcing policies and methods for governing the installation of software by users; mechanisms monitoring policy compliance].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001806.

Control	Description
CM-11	a: Establish [policies governing the installation of software by users are defined;] governing the installation of software by users; b: Enforce software installation policies through the following methods: [methods used to enforce software installation policies are defined;] ; and c: Monitor policy compliance [frequency with which to monitor compliance is defined;].