Software Usage Restrictions CM-10

Configuration Management · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CM-10 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CM-10 (Software Usage Restrictions) is about using software within the rules: honor contract and license terms and copyright law, track software that is licensed by quantity so you do not exceed what you paid for, and control peer-to-peer (P2P, software that shares files directly between machines) file sharing so it is not used to trade copyrighted work. It is a Low-baseline control.

What good looks like

Use software only within its license and contract terms — ‘free for personal use’ is not the same as free for a server, and terms vary.
Track quantity-licensed software so the number of installs stays within what you are entitled to.
Keep an inventory of installed software so ‘what do we run, and are we allowed to’ has an answer you can check.
Control peer-to-peer (P2P) file sharing so it is not used to distribute copyrighted material from your system.
Remove unauthorized or unlicensed software when you find it, and record why it was removed.

Framework mapping

NIST CSF 2.0 — PR.PS-01 — Configuration management practices are established and applied
CIS Controls v8 — Control 2 — Inventory and Control of Software Assets

How to move it toward Implemented

Build a software inventory as a dated file so you can check it against your licenses (dpkg -l on Debian/Ubuntu or rpm -qa on Red Hat-based systems).
Note the license for anything not covered by the base distribution — a short list of package, source, and license terms.
Check for and remove peer-to-peer or unlicensed software (search the package list for known P2P clients and uninstall any you find with sudo apt remove or sudo dnf remove).
Where practical, keep installs to trusted repositories and restrict who has the sudo rights to add software (this ties back to CM-5).
Attach the software inventory and license notes as hardening evidence on the asset, naming CM-10 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.