AO coverage. Addresses all three User-installed Software objectives: an installation policy is established [a], installation is controlled per that policy [b], and installation is monitored [c].

Policy [a]. Users may install only from the self-service catalog. Anything else requires a ticket with a business justification, a license record, and a security review that covers the vendor's data handling — an important point for tools that upload telemetry or documents. The policy names who approves (the requester's manager plus security for anything that touches CUI paths) and states plainly that developer convenience is not by itself a justification on enclave devices.

Control [b]. Local administrator rights are removed on both platforms, so the catalog is the practical installation path. Catalog contents are curated: each item has an owner, a version pinned by the packaging pipeline, and a security review date. On CUI endpoints the application allow-listing described in the CM.L2-3.4.8 example means an unapproved installer that somehow lands on disk still will not execute — the two controls are deliberately layered because removing rights alone did not stop portable applications.

Monitoring [c]. Software inventory is collected daily and diffed weekly against the approved catalog and the per-role manifests. Unexpected software opens a ticket routed to the device owner, and the pattern of requests is reviewed monthly — repeated demand for the same tool is a signal to evaluate and add it, not to keep saying no, which is what keeps people out of workarounds.

Maintenance. Weekly diff review; monthly demand analysis; quarterly catalog review that also removes items nobody has installed in six months. New catalog items require a completed security review before publication.

Accepted gap. Two developers need package managers that install into their home directory to do their jobs. Those installations are scoped to non-CUI project directories, the package manifests are inventoried and reviewed monthly, and the devices are excluded from the enclave. The alternative — blocking them outright — was tried and produced shadow IT, which was worse.

• Written installation policy with approval roles and justification requirements
• Catalog contents with owners, pinned versions, and review dates
• Configuration showing local administrator rights removed on both platforms
• Weekly inventory diff report and a resulting ticket
• Monthly demand analysis notes and the package-manager exception record