myctrl.tools
Compare

CM-7(4)—Unauthorized Software -- Deny-By-Exception

>Control Description

a

Identify ⚙organization-defined software programs not authorized to execute on the system;

b

Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and

c

Review and update the list of unauthorized software programs ⚙organization-defined frequency.

>Cross-Framework Mappings

SCF

CFG-03.3
Compare

>Supplemental Guidance

Unauthorized software programs can be limited to specific versions or from a specific source. The concept of prohibiting the execution of unauthorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses.

>Related Controls

CM-6
CM-8
CM-10
PL-9
PM-5

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of CM-7(4) (Unauthorized Software -- Deny-By-Exception)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring CM-7(4)?
  • •How frequently is the CM-7(4) policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to CM-7(4)?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce CM-7(4) requirements.
  • •What automated tools, systems, or technologies are deployed to implement CM-7(4)?
  • •How is CM-7(4) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce CM-7(4) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of CM-7(4)?
  • •What audit logs, records, reports, or monitoring data validate CM-7(4) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of CM-7(4) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate CM-7(4) compliance?

Ask AI

Configure your API key to use AI features.