What it asks for. The organisation must establish policies governing user installation of software, enforce them through defined methods and monitor compliance at a defined frequency.
In practice. This means removing local administrator rights, offering a self-service catalogue of approved software, and using application control or endpoint management to block or detect unapproved installs. Auditors expect the policy, technical enforcement settings and software inventory reports showing exceptions. CIS Control 2 covers similar ground. Developers may need controlled exceptions, which should be documented and time-limited.
Common gaps. Users with local admin rights can install anything, including remote access tools that attackers abuse. Browser extensions and portable applications are often outside monitoring. Exceptions granted for one user often become permanent.