id: "CM-11(03)" title: "Automated Enforcement and Monitoring" family: "CM" family_name: "Configuration Management" sort_id: "cm-11.03" priority: "P1" implementation_level: "system" parent: "CM-11" enhancement: True
Statement
Enforce and monitor compliance with software installation policies using {{ insert: param, cm-11.3_prm_1 }}.
Guidance
Organizations enforce and monitor compliance with software installation policies using automated mechanisms to more quickly detect and respond to unauthorized software installation which can be an indicator of an internal or external hostile attack.
Assessment Objective: compliance with software installation policies is enforced using {{ insert: param, cm-11.03_odp.01 }};
Assessment Objective: compliance with software installation policies is monitored using {{ insert: param, cm-11.03_odp.02 }}.
Configuration management policy
procedures addressing user-installed software
configuration management plan
system security plan
system design documentation
system configuration settings and associated documentation
list of rules governing user installed software
system monitoring records
system audit records
continuous monitoring strategy
system security plan
other relevant documents or records
Organizational personnel with responsibilities for governing user-installed software
organizational personnel operating, using, and/or maintaining the system
organizational personnel monitoring compliance with user-installed software policy
organizational personnel with information security responsibilities
system/network administrators
Organizational processes governing user-installed software on the system
automated mechanisms enforcing policies on installation of software by users
automated mechanisms monitoring policy compliance