ISO 27701:2019 6.9.5: Control of operational software

What else in your programme already covers this

This control maps to 41 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 5 controls

2.2.4 2.2.4 Only necessary functionality enabled
9.4.4 9.4.4 Management approval for media leaving facility
5.2.1 5.2.1 Anti-malware deployed on all system components
6.3.3 6.3.3 Timely installation of security patches
6.5.1 6.5.1 Change control procedure for production

CIS Controls v8 · 4 controls

CIS-2.1 Establish and Maintain a Software Inventory
CIS-2.3 Address Unauthorized Software
CIS-2.5 Allowlist Authorized Software
CIS-4.6 Securely Manage Enterprise Assets and Software

ISO 27001:2022 · 4 controls

8.19 Installation of software on operational systems
8.32 Change management
8.8 Management of technical vulnerabilities
8.9 Configuration management

SOC 2 · 4 controls

SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-PR.PS-01 Configuration management practices are established and applied
NIST-CSF-PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented

NIST SP 800-161 Rev 1 · 3 controls

161R1-CM-10 Software Usage Restrictions
161R1-CM-11 User-Installed Software
161R1-CM-14 Signed Components

NIST SP 800-53 Rev 5 · 3 controls

NIST800-CM-7 CM-7 Least Functionality
NIST800-SA-10 SA-10 Developer Configuration Management
SP800-53-CM Configuration Management Family

C5 (Germany) · 2 controls

C5-AM-02 Acceptable Use and Safe Handling of Assets Policy
C5-DEV-09 Approvals for provision in the production environment

CMMC 2.0 · 2 controls

CM.L2-3.4.8 Application Execution Policy
CM.L2-3.4.9 User-Installed Software

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-CCC-02 Quality Testing
CCM-CCC-04 Unauthorized Change Protection

FedRAMP High · 2 controls

CM-11 User-Installed Software
CM-5 Access Restrictions for Change

FedRAMP Moderate · 2 controls

CM-11 User-Installed Software
CM-5 Access Restrictions for Change

AWS Well-Architected Security Pillar · 1 control

SEC06-BP02 Provision compute from hardened images

Azure Security Benchmark · 1 control

ASBv3-AM-5 Use only approved applications in virtual machine

NIST SP 800-171 Rev 3 · 1 control

03.04.08 Authorized Software - Allow by Exception

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.9.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gaps If you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gaps If you hold ISO 27001:202243.5% covered · 61 gaps If you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gaps If you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 each Browse the graph free