PR.PS-05: Installation and execution of unauthorized software are prevented

Info icon.

Subcategory is new to this version of the framework.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software

Ex2: Verify the source of new software and the software's integrity before installing it

Ex3: Configure platforms to use only approved DNS services that block access to known malicious domains

Ex4: Configure platforms to allow the installation of organization-approved software only

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

SC-34: Non-modifiable Executable Programs

For [Assignment: organization-defined system components] , load and execute: The operating environment from hardware-enforced, read-only media; and The following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications].

Cloud Controls Matrix v4.0

UEM-02: Application and Service Approval

Define, document, apply and evaluate a list of approved services, applications and sources of applications (stores) acceptable for use by endpoints when accessing or storing organization-managed data.

Critical Security Controls Version 8.1

2.5: Allowlist Authorized Software

Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.