What it asks for. This control expects procedures and measures to be implemented to securely manage software installation on operational systems. Its purpose is to protect the integrity of operational systems and prevent exploitation of technical vulnerabilities.
In practice. Good practice means only authorised staff can install software on production systems, installations go through change management and testing, and users are restricted from installing software on their devices, for example through application control or managed app stores. Vendor-supplied software is kept at supported versions. Auditors look for installation rules, change records and technical restrictions.
Common gaps. Typical gaps are local administrator rights for end users, unapproved tools on servers and browser extensions that are not controlled. Software installed for troubleshooting is often never removed, and installed software is not compared against an approved list.