CM-11: User-installed Software

Quick-reference card

What this control requires

CM-11 requires organizations to define policies governing user-installed software, enforce those policies, and monitor compliance continuously. Without explicit control over what users install, you lose visibility into what’s running across your environment and expose yourself to preventable risk.

In practice, this control means drawing a clear line between permitted and prohibited installations. Permitted actions typically include security patches, approved updates, and downloads from organization-sanctioned application repositories. Prohibited actions cover software with unknown origins, unvetted applications, and anything your organization deems potentially malicious.

Your enforcement methods can be procedural, such as written approval workflows, or automated, such as application allowlisting and endpoint management tooling. Configuration management serves as the foundation for maintaining this boundary over time.

The monitoring component is what separates a paper policy from an effective control. You need to define how frequently compliance is checked, whether through automated scanning, periodic audits, or continuous endpoint telemetry, and act on violations when they’re found.

Why it matters

When users install software outside your approved channels, every unvetted application becomes a gap in your configuration baseline that auditors will flag and attackers will find. Failure to maintain this control introduces audit risk and may result in certification withdrawal or regulatory findings during federal assessments.

In practice, the compliance exposure is especially concentrated because CM-11 appears across all three NIST baselines. Auditors expect documented policies, evidence of enforcement, and records showing ongoing monitoring. If any of those elements are missing or inconsistent, the control is assessed as not satisfied, and your authorization to operate may be at risk.

Beyond audit exposure, unmanaged user installations create real operational blind spots. Software that bypasses your configuration baseline can conflict with approved applications, introduce licensing violations, or open network connections your security team doesn’t monitor.

What attackers exploit

• Trojanized installers and fake update prompts that trick users into downloading malware disguised as legitimate software
• Spyware** bundled with freeware applications** that exfiltrates credentials, keystrokes, or sensitive data without user awareness
• Shadow IT applications that bypass network controls, creating unmonitored communication channels or data storage outside your security perimeter
• Privilege escalation through vulnerable software where outdated or unvetted applications contain known exploitable flaws that give attackers a foothold on the endpoint

How to implement

Most CM-11 failures don’t stem from missing policy documents. They stem from policies that exist on paper but aren’t enforced technically or monitored consistently, leaving a gap between what the organization says it does and what actually happens on endpoints.

For your organization

Define permitted and prohibited software categories. Start by creating a software installation policy that explicitly identifies what users are allowed to install, what requires approval, and what is outright prohibited. Avoid vague language. Name the categories: approved application stores, sanctioned update mechanisms, prohibited software classes such as peer-to-peer clients, unauthorized remote access tools, and applications with unknown provenance.

Select and deploy enforcement mechanisms. Application allowlisting is widely recognized as a primary technical enforcement method for software installation controls. Configure endpoint management tools to restrict installations to approved software lists. Where allowlisting isn’t feasible across all systems, implement privilege restrictions that prevent standard user accounts from executing installers. Complement these technical controls with procedural mechanisms like software request and approval workflows.

Establish monitoring cadence and response procedures. Define how frequently you’ll scan endpoints for policy violations, whether daily, weekly, or through continuous monitoring agents. Ensure your monitoring captures installation events, not just the presence of software, so you can detect and respond to violations promptly. Document what happens when a violation is found, including removal procedures, user notification, and escalation paths.

Produce and maintain evidence artifacts. Your configuration management plan should reference the software installation policy. System configuration settings should reflect enforcement mechanisms. Audit logs should demonstrate that monitoring is occurring at the defined frequency. Review and update your approved software list regularly, especially as new applications are requested or threat intelligence reveals risks in previously permitted configuration management tools.

Common mistakes to avoid. Don’t rely solely on user training without technical enforcement. Make sure your policies are specific enough to be enforceable. Update your approved software lists as business needs evolve, and always act on detected violations rather than letting them accumulate in reports.

For your vendors

Ask targeted questionnaire questions. Request specifics about how the vendor controls software installation in their environment. Key questions include: “Do you maintain a policy governing user-installed software?” “What technical enforcement methods are in place?” “How frequently do you monitor for unauthorized installations?” “What is your process when unauthorized software is detected?”

Request specific evidence. Generic policy documents aren’t sufficient. Ask for the actual software installation policy, evidence of technical enforcement such as endpoint management configurations or allowlisting tool screenshots, and sample monitoring reports showing detection and remediation of violations. Request audit log excerpts that demonstrate monitoring at the stated frequency.

Watch for red flags. Be cautious if a vendor can only produce a high-level policy with no evidence of technical enforcement. If monitoring records show no violations over extended periods, that may indicate the monitoring isn’t detecting anything rather than perfect compliance. Vendors who rely exclusively on procedural controls, such as “we tell employees not to install unauthorized software,” without any technical backstop present elevated risk.

Verify beyond self-attestation. Where possible, validate vendor claims through independent assessment reports, penetration test results that include endpoint configuration reviews, or direct observation during site assessments. Cross-reference their software installation controls with their broader configuration management program to ensure consistency.

Evidence examples

Cross-framework mapping

Related controls

The following controls work alongside CM-11 to form a complete configuration management and access enforcement program:

• AC-03 — Access Enforcement: restricts system access to authorized users and processes, supporting software installation privilege limitations
• AU-06 — Audit Record Review, Analysis, and Reporting: provides the audit review processes needed to analyze software installation monitoring records
• CM-02 — Baseline Configuration: establishes the approved system configuration against which unauthorized software installations are detected
• CM-03 — Configuration Change Control: governs the change control process that software installation requests should follow
• CM-05 — Access Restrictions for Change: limits who can make configuration changes, including software installations, to authorized personnel
• CM-06 — Configuration Settings: defines the specific configuration parameters that enforce software installation restrictions on endpoints
• CM-07 — Least Functionality: restricts system functions to only those required, complementing software installation restrictions
• CM-08 — System Component Inventory: maintains the inventory of authorized system components, including approved software
• PL-04 — Rules of Behavior: documents acceptable use expectations, including software installation responsibilities for users
• SI-04 — System Monitoring: provides the monitoring infrastructure used to detect unauthorized software installations and policy violations

Frequently asked questions

What is NIST SP 800-53 CM-11

CM-11 requires organizations to establish and enforce policies governing user-installed software and to monitor compliance at a defined frequency. Unlike broader configuration management controls, CM-11 specifically targets the moment a user initiates an installation, making it the gatekeeper between your approved baseline and unvetted code. Assessors evaluate three discrete objectives: that policies exist, that enforcement methods function as documented, and that monitoring records prove ongoing compliance checks.

What happens if CM-11 is not implemented

Without CM-11, assessors will record a finding against your configuration management program, specifically citing the absence of software installation policies, missing enforcement evidence, and no monitoring records at a defined frequency. For federal systems, this deficiency can delay or block your authorization to operate. The downstream impact extends beyond audit findings: your system component inventory under CM-08 becomes unreliable when untracked software is present, and your baseline configuration under CM-02 drifts without detection.

How do you audit CM-11

Auditors verify CM-11 by examining your software installation policy for completeness, testing that your enforcement methods actually prevent unauthorized installations, and reviewing monitoring records to confirm compliance checks occur at the defined frequency. The assessment evaluates three objectives: that policies governing user-installed software exist, that enforcement methods are implemented and functional, and that monitoring produces documented evidence of compliance status. Expect assessors to request system configuration settings showing allowlisting or privilege restrictions alongside audit logs capturing installation events.

What is the difference between CM-10 and CM-11

CM-10 addresses software usage restrictions, focusing on licensing compliance and terms-of-use enforcement for software already present in the environment. CM-11, by contrast, governs the act of installation itself, controlling what users are permitted to install and how those permissions are enforced. In practice, CM-10 ensures you’re using software within its license terms, while CM-11 ensures unauthorized software never reaches your systems in the first place. Both controls reference your configuration management policy, but they target different stages of the software lifecycle.