NIST 800-53 REV 5 • CONFIGURATION MANAGEMENT
CM-2(5) — Authorized Software
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Practitioner Notes
This enhancement was incorporated into CM-7. It previously focused on maintaining a list of authorized software and allowing only that software to run.
Example 1: Implement AppLocker policies via Group Policy to create an allowlist of approved applications that can execute on user workstations.
Example 2: Maintain an approved software catalog in Intune or SCCM and use application deployment policies to ensure only listed software is available to users.