NIST 800-53 REV 5 • CONFIGURATION MANAGEMENT

CM-2(5)Authorized Software

CMMC Practice Mapping

No direct CMMC mapping

NIST 800-171 Mapping

No direct NIST 800-171 mapping

Related Controls

No related controls listed

Practitioner Notes

This enhancement was incorporated into CM-7. It previously focused on maintaining a list of authorized software and allowing only that software to run.

Example 1: Implement AppLocker policies via Group Policy to create an allowlist of approved applications that can execute on user workstations.

Example 2: Maintain an approved software catalog in Intune or SCCM and use application deployment policies to ensure only listed software is available to users.