NIST SP 800-53 Rev 5
CM - Configuration Management

NIST SP 800-53 Rev 5 NIST800-CM-10: CM-10 Software Usage Restrictions

a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and c. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 36 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 7 controls

  • CIS-2.1 Establish and Maintain a Software Inventory
  • CIS-2.2 Ensure Authorized Software is Currently Supported
  • CIS-2.3 Address Unauthorized Software
  • CIS-2.5 Allowlist Authorized Software
  • CIS-2.6 Allowlist Authorized Libraries
  • CIS-2.7 Allowlist Authorized Scripts
  • CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients

ISO 27002:2022 · 5 controls

  • 5.10 Acceptable use of information and other associated assets
  • 5.32 Intellectual property rights
  • 8.19 Installation of software on operational systems
  • 8.7 Protection against malware
  • 8.9 Configuration management

PCI DSS 4.0 · 4 controls

  • 2.2.4 2.2.4 Only necessary functionality enabled
  • 5.2.1 5.2.1 Anti-malware deployed on all system components
  • 5.2.2 5.2.2 Anti-malware detects and handles all known malware
  • 6.5.1 6.5.1 Change control procedure for production
  • AM-2 Use only approved services
  • ASBv3-AM-5 Use only approved applications in virtual machine
  • ASD37-01 Application control (Essential)
  • SEC11-BP05 Centralize services for packages and dependencies
  • AUCDR-IS-5 Limit, prevent, detect and remove malware

CMMC 2.0 · 1 control

EU AI Act · 1 control

  • EUAI-Art.53 Obligations for providers of general-purpose AI models

FedRAMP High · 1 control

  • CM-10 Software Usage Restrictions

FedRAMP Moderate · 1 control

  • CM-10 Software Usage Restrictions

ISO 27001:2022 · 1 control

  • 5.32 Intellectual property rights

NIST SP 800-172 · 1 control

  • 3.4.1e Authoritative Source for Software and Firmware
  • CM-10 CM-10 Software Usage Restrictions
  • CM-10 CM-10 Software Usage Restrictions
  • CM-10 CM-10 Software Usage Restrictions

SOC 2 · 1 control

  • SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software

UK Cyber Essentials · 1 control

  • CE-SU.1 Software Licensed and Supported

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CM - Configuration Management

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-CM-10 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

Query this from an agent

The graph holds this control, the 36 it maps to, and the evidence behind each claim, over MCP and REST.