NIST SP 800-53 Rev 5
CM - Configuration Management

NIST SP 800-53 Rev 5 NIST800-CM-10: Software usage restrictions

Requires software and its documentation to be used within contract and copyright terms, use of quantity licensed software to be tracked so copying and distribution stay controlled, and peer to peer file sharing to be controlled and documented so it cannot be used to distribute copyrighted work.

What else in your programme already covers this

This control maps to 36 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 7 controls

  • CIS-2.1 Establish and Maintain a Software Inventory
  • CIS-2.2 Ensure Authorized Software is Currently Supported
  • CIS-2.3 Address Unauthorized Software
  • CIS-2.5 Allowlist Authorized Software
  • CIS-2.6 Allowlist Authorized Libraries
  • CIS-2.7 Allowlist Authorized Scripts
  • CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients

ISO 27002:2022 · 5 controls

  • 5.10 Acceptable use of information and other associated assets
  • 5.32 Intellectual property rights
  • 8.19 Installation of software on operational systems
  • 8.7 Protection against malware
  • 8.9 Configuration management

PCI DSS 4.0 · 4 controls

  • 2.2.4 Only necessary services enabled
  • 5.2.1 An anti-malware solution(s) is deployed on all system components, except for those system components identified in periodic evaluations per Requirement 5.2.3 that concludes the system components are not at risk from malware
  • 5.2.2 The deployed anti-malware solution(s): • Detects all known types of malware. • Removes, blocks, or contains all known types of malware
  • 6.5.1 Changes to all system components in the production environment are made according to established procedures that include: • Reason for, and description of, the change. • Documentation of security impact. • Documented change approval
  • AM-2 Use only approved services
  • ASBv3-AM-5 Use only approved applications in virtual machine
  • ASD37-01 Application control (Essential)
  • SEC11-BP05 Centralize services for packages and dependencies
  • AUCDR-IS-5 Limit, prevent, detect and remove malware

CMMC 2.0 · 1 control

EU AI Act · 1 control

  • EUAI-Art.53 Obligations for providers of general-purpose AI models

FedRAMP High · 1 control

  • CM-10 Software Usage Restrictions

FedRAMP Moderate · 1 control

  • CM-10 Software Usage Restrictions

ISO 27001:2022 · 1 control

  • 5.32 Intellectual property rights

NIST SP 800-172 · 1 control

  • 3.4.1e Authoritative Source for Software and Firmware
  • CM-10 Software Usage Restrictions
  • CM-10 Software Usage Restrictions
  • CM-10 Software Usage Restrictions

SOC 2 · 1 control

  • SOC2-CC6.8 Controls to prevent or detect unauthorized or malicious software

UK Cyber Essentials · 1 control

  • CE-SU.1 Software Licensed and Supported

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CM - Configuration Management

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-CM-10 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 300 NIST SP 800-53 Rev 5 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

Query this from an agent

The graph holds this control, the 36 it maps to, and the evidence behind each claim, over MCP and REST.