Skip to content
ControlVerdict
Sign in
CM.L2-3.4.9CMMC Level 2Level 2

User-installed Software

Submit your own example

Practice statement

Control and monitor user-installed software.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.4.9.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(3)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    a policy for controlling the installation of software by users is established;

    1 example covers this

  2. [b]

    installation of software by users is controlled based on the established policy; and

    1 example covers this

  3. [c]

    installation of software by users is monitored.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    CM.L2-3.4.9User-installed Software
    Control and monitor user-installed software.

    • [a]

      a policy for controlling the installation of software by users is established;

    • [b]

      installation of software by users is controlled based on the established policy; and

    • [c]

      installation of software by users is monitored.

    Self-service catalog for approved software; everything else shows up in the weekly diff

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses all three User-installed Software objectives: an installation policy is established [a], installation is controlled per that policy [b], and installation is monitored [c].

    Policy [a]. Users may install only from the self-service catalog. Anything else requires a ticket with a business justification, a license record, and a security review that covers the vendor's data handling — an important point for tools that upload telemetry or documents. The policy names who approves (the requester's manager plus security for anything that touches CUI paths) and states plainly that developer convenience is not by itself a justification on enclave devices.

    Control [b]. Local administrator rights are removed on both platforms, so the catalog is the practical installation path. Catalog contents are curated: each item has an owner, a version pinned by the packaging pipeline, and a security review date. On CUI endpoints the application allow-listing described in the CM.L2-3.4.8 example means an unapproved installer that somehow lands on disk still will not execute — the two controls are deliberately layered because removing rights alone did not stop portable applications.

    Monitoring [c]. Software inventory is collected daily and diffed weekly against the approved catalog and the per-role manifests. Unexpected software opens a ticket routed to the device owner, and the pattern of requests is reviewed monthly — repeated demand for the same tool is a signal to evaluate and add it, not to keep saying no, which is what keeps people out of workarounds.

    Maintenance. Weekly diff review; monthly demand analysis; quarterly catalog review that also removes items nobody has installed in six months. New catalog items require a completed security review before publication.

    Accepted gap. Two developers need package managers that install into their home directory to do their jobs. Those installations are scoped to non-CUI project directories, the package manifests are inventoried and reviewed monthly, and the devices are excluded from the enclave. The alternative — blocking them outright — was tried and produced shadow IT, which was worse.

    What the evidence looks like

    • Written installation policy with approval roles and justification requirements
    • Catalog contents with owners, pinned versions, and review dates
    • Configuration showing local administrator rights removed on both platforms
    • Weekly inventory diff report and a resulting ticket
    • Monthly demand analysis notes and the package-manager exception record

    Environment

    Mixed macOS and Windows engineering shop, ~70 staff, where local administrator rights were removed six months ago and the support queue is still adjusting.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.