NIST SP 800-172
CM

NIST SP 800-172 3.4.2e: Automated Detection and Remediation of Unauthorized Software

Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place them in a quarantine or remediation environment.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 62 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 7 controls

CIS Controls v8 · 6 controls

  • CIS-1.2 Address Unauthorized Assets
  • CIS-1.3 Utilize an Active Discovery Tool
  • CIS-10.1 Deploy and Maintain Anti-Malware Software
  • CIS-2.3 Address Unauthorized Software
  • CIS-4.1 Establish and Maintain a Secure Configuration Process
  • CIS-4.6 Securely Manage Enterprise Assets and Software

Azure Security Benchmark · 5 controls

  • ASBv3-AM-5 Use only approved applications in virtual machine
  • ASBv3-NS-8 Detect and disable insecure services and protocols
  • ASBv3-PV-1 Define and establish secure configurations
  • ASBv3-PV-4 Audit and enforce secure configurations for compute resources
  • PV-2 Audit and enforce secure configurations

FedRAMP High · 5 controls

  • CM-11 User-Installed Software
  • CM-6(1) Automated Management, Application, and Verification
  • CM-7(2) Prevent Program Execution
  • CM-8(3) Automated Unauthorized Component Detection
  • SI-3 Malicious Code Protection

FedRAMP Moderate · 5 controls

  • CM-11 User-Installed Software
  • CM-6(1) Automated Management, Application, and Verification
  • CM-7(2) Prevent Program Execution
  • CM-8(3) Automated Unauthorized Component Detection
  • SI-3 Malicious Code Protection

PCI DSS 4.0 · 5 controls

  • 10.7.2 10.7.2 Detect and alert on critical security control failures
  • 11.2.1 11.2.1 Detect authorized and rogue wireless access points
  • 11.5.2 11.5.2 Change detection on critical files
  • 2.2.1 2.2.1 System configuration standards maintained
  • 5.2.1 5.2.1 Anti-malware deployed on all system components

CMMC 2.0 · 4 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

ISO 27001:2022 · 3 controls

  • 8.19 Installation of software on operational systems
  • 8.7 Protection against malware
  • 8.9 Configuration management

ISO 27002:2022 · 3 controls

  • 8.19 Installation of software on operational systems
  • 8.7 Protection against malware
  • 8.9 Configuration management

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
  • NIST-CSF-PR.PS-01 Configuration management practices are established and applied
  • NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented

NIST SP 800-161 Rev 1 · 3 controls

NIST SP 800-171 Rev 3 · 2 controls

  • 03.04.02 Configuration Settings
  • 03.04.08 Authorized Software - Allow by Exception

SOC 2 · 2 controls

  • SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software
  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-07 Authorise Network Connection Only for Managed Equipment

C5 (Germany) · 1 control

  • C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening

HIPAA Security Rule · 1 control

NIST SP 800-218 · 1 control

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CM

You are reading one control. How much of NIST SP 800-172 have you already done?

NIST SP 800-172 3.4.2e is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-172 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 24 of 35 NIST SP 800-172 controls already carry evidence.

If you hold NIST SP 800-53 Rev 568.6% covered · 11 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.165.7% covered · 12 gapsIf you hold NIST SP 800-161 Rev 162.9% covered · 13 gapsIf you hold FedRAMP Moderate60% covered · 14 gapsIf you hold NIST Cybersecurity Framework 2.048.6% covered · 18 gapsIf you hold C5 (Germany)45.7% covered · 19 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 5 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 62 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-172 controls