Navigate

CM-7(2)

CM-7(2): Prevent Program Execution

Prevent program execution in accordance with [one or more of "{{ insert: param, cm-07.02_odp.02 }} "/"rules authorizing the terms and conditions of software program usage"].

Supplemental

Prevention of program execution addresses organizational policies, rules of behavior, and/or access agreements that restrict software usage and the terms and conditions imposed by the developer or manufacturer, including software licensing and copyrights. Restrictions include prohibiting auto-execute features, restricting roles allowed to approve program execution, permitting or prohibiting specific software programs, or restricting the number of program instances executed at the same time.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-7(2).

Control	Description
CM-8	a: Develop and document an inventory of system components that: 1: Accurately reflects the system; 2: Includes all components within the system; 3: Does not include duplicate accounting of components or components assigned to any other system; 4: Is at the level of granularity deemed necessary for tracking and reporting; and 5: Includes the following information to achieve system component accountability: [information deemed necessary to achieve effective system component accountability is defined;] ; and b: Review and update the system component inventory [frequency at which to review and update the system component inventory is defined;].
PL-4	a: Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b: Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system; c: Review and update the rules of behavior [frequency for reviewing and updating the rules of behavior is defined;] ; and d: Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [one or more of "{{ insert: param, pl-04_odp.03 }} "/"when the rules are revised or updated"].
PL-9	Centrally manage [security and privacy controls and related processes to be centrally managed are defined;].
PM-5	Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.
PS-6	a: Develop and document access agreements for organizational systems; b: Review and update the access agreements [the frequency at which to review and update access agreements is defined;] ; and c: Verify that individuals requiring access to organizational information and systems: 1: Sign appropriate access agreements prior to being granted access; and 2: Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [the frequency at which to re-sign access agreements to maintain access to organizational information is defined;].

Enhancements

The controls below (if any) add on to the requirements of CM-7(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-7(2).

CCI	Definition
CCI-001592	Defines the rules authorizing the terms and conditions of software program usage on the system.
CCI-001763	Defines the policies regarding software program usage and restrictions.
CCI-001764	Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.