What it asks for. The organisation should track all software installed or running on its assets and ensure that only authorised, supported software can be installed and executed. Unsupported or unapproved software is a common entry point and should be found and removed.
In practice. Mature teams maintain a software inventory with publisher, version, business purpose and support status, generated automatically from endpoint and server tooling rather than by hand. An approved software list is backed by technical enforcement, such as application allowlisting for high risk systems, and end of life software is either replaced or formally accepted as a risk with compensating controls. Evidence includes the inventory, allowlisting policies and records of unauthorised software being removed.
Common gaps. Typical weaknesses are browser extensions, scripts, libraries and SaaS tools that never appear in the inventory, and allowlisting that stays in audit mode indefinitely. End of life software frequently lingers without a documented exception.