[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcm-11":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cm-11","CM-11","User-installed Software",6,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must establish policies governing user installation of software, enforce them through defined methods and monitor compliance at a defined frequency.\n\n**In practice.** This means removing local administrator rights, offering a self-service catalogue of approved software, and using application control or endpoint management to block or detect unapproved installs. Auditors expect the policy, technical enforcement settings and software inventory reports showing exceptions. CIS Control 2 covers similar ground. Developers may need controlled exceptions, which should be documented and time-limited.\n\n**Common gaps.** Users with local admin rights can install anything, including remote access tools that attackers abuse. Browser extensions and portable applications are often outside monitoring. Exceptions granted for one user often become permanent.","a. Establish [Assignment: organization-defined policies] governing the installation of software by users;\n  b. Enforce software installation policies through the following methods: [Assignment: organization-defined methods] ; and\n  c. Monitor policy compliance [Assignment: organization-defined frequency].\nDiscussion: If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved \"app stores.\" Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"opc-ua-lds-installer-flaw-enables-privilege-escalation-via-local-access","OPC UA LDS Installer Flaw Enables Privilege Escalation via Local Access","2026-09-03T18:22:59.242+00:00",{"slug":25,"title":26,"published_at":27},"multiple-zero-day-exploits-and-supply-chain-compromises-highlight-critical-security-gaps","Multiple Zero-Day Exploits and Supply Chain Compromises Highlight Critical Security Gaps","2026-06-15T16:21:35.636+00:00",{"slug":29,"title":30,"published_at":31},"wordpress-plugin-vulnerability-enables-complete-site-takeover","WordPress Plugin Vulnerability Enables Complete Site Takeover","2026-06-08T14:21:06.893+00:00",{"slug":33,"title":34,"published_at":35},"malicious-pypi-packages-compromise-developer-environments-through-supply-chain-attack","Malicious PyPI Packages Compromise Developer Environments Through Supply Chain Attack","2026-06-07T10:20:18.388+00:00",{"slug":37,"title":38,"published_at":39},"mirax-android-rat-exploits-user-trust-and-device-configuration-weaknesses","Mirax Android RAT Exploits User Trust and Device Configuration Weaknesses","2026-04-14T14:10:01.643+00:00",{"slug":41,"title":42,"published_at":43},"android-malware-infects-23m-devices-through-app-store-supply-chain","Android Malware Infects 2.3M Devices Through App Store Supply Chain","2026-04-01T20:07:53.294+00:00",[45,50,54,59,63,68],{"slug":46,"name":47,"problem":48,"stories":49},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":51,"name":52,"problem":53,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57,"stories":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":60,"name":61,"problem":62,"stories":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":64,"name":65,"problem":66,"stories":67},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,{"slug":69,"name":70,"problem":71,"stories":67},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[73,78,83,87,91,95,100,104],{"family":74,"item":75,"code":76,"title":77,"together":49},"cis","7","Control 7","Continuous Vulnerability Management",{"family":5,"item":79,"code":80,"title":81,"together":82},"si-2","SI-2","Flaw Remediation",3,{"family":84,"item":84,"code":85,"title":86,"together":58},"owasp","OWASP","OWASP (Open Worldwide Application Security Project)",{"family":74,"item":88,"code":89,"title":90,"together":58},"2","Control 2","Inventory and Control of Software Assets",{"family":74,"item":92,"code":93,"title":94,"together":58},"11","Control 11","Data Recovery",{"family":96,"item":97,"code":98,"title":99,"together":58},"nist-sp","800-124","SP 800-124","SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise",{"family":74,"item":101,"code":102,"title":103,"together":67},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":74,"item":105,"code":106,"title":107,"together":67},"12","Control 12","Network Infrastructure Management"]