Assessment Objective

Determine if:

• software programs authorized to execute on the system are identified.
• a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.
• the list of authorized software programs is reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for least functionality in the system
• configuration management plan
• system design documentation
• system configuration settings
• list of software programs authorized to execute on the system
• system component inventory
• records associated with the review and update of the list of authorized software programs
• common secure configuration checklists
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for identifying software authorized to execute on the system
• personnel with information security responsibilities
• system administrators

Test

• processes for identifying, reviewing, and updating programs authorized to execute on the system
• processes for implementing authorized software policy
• mechanisms for supporting or implementing authorized software policy

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final