NIST SP 800-167 Guide to Application Whitelisting 3.1a: Define application whitelisting requirements and capture the decisions in policy

What does 3.1a require?

During initiation the organisation identifies current and future needs: any external requirement for whitelisting, the operating systems and applications of the devices in scope, and the interfaces to systems such as central logging and SIEM. The analysis settles which application components are monitored (executables, libraries, registry keys, configuration files and the like), which threats are addressed and which whitelisting type balances security, usability and maintainability, for example blocking on higher-risk clients while only monitoring lower-risk ones; these decisions are written into policy.