Navigate

CM-10

CM-10: Software Usage Restrictions

The organization:

CM-10a.: Uses software and associated documentation in accordance with contract agreements and copyright laws;

CM-10b.: Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

CM-10c.: Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Supplemental

Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-10.

Control	Description
AC-17	The organization: AC-17a.: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and AC-17b.: Authorizes remote access to the information system prior to allowing such connections.
CM-8	The organization: CM-8a.: Develops and documents an inventory of information system components that: CM-8a.1.: Accurately reflects the current information system; CM-8a.2.: Includes all components within the authorization boundary of the information system; CM-8a.3.: Is at the level of granularity deemed necessary for tracking and reporting; and CM-8a.4.: Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and CM-8b.: Reviews and updates the information system component inventory [Assignment: organization-defined frequency].
SC-7	The information system: SC-7a.: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; SC-7b.: Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and SC-7c.: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

Enhancements

The controls below (if any) add on to the requirements of CM-10.

Control	Description
CM-10 (1)	The organization establishes the following restrictions on the use of open source software: [Assignment: organization-defined restrictions].

Related CCIs

The CCIs below are tied to CM-10.

CCI	Definition
CCI-001726	The organization uses software in accordance with contract agreements.
CCI-001727	The organization uses software documentation in accordance with contract agreements.
CCI-001728	The organization uses software in accordance with copyright laws.
CCI-001729	The organization uses software documentation in accordance with copyright laws.
CCI-001730	The organization tracks the use of software protected by quantity licenses to control copying of the software.
CCI-001731	The organization tracks the use of software documentation protected by quantity licenses to control distribution of the software documentation.
CCI-001732	The organization controls the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CCI-001733	The organization documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CCI-001802	The organization tracks the use of software documentation protected by quantity licenses to control copying of the software documentation.
CCI-001803	The organization tracks the use of software protected by quantity licenses to control distribution of the software.