Key takeaways
- Control software installation on live systems.
- Uncontrolled software installation introduces malware and licence issues.
- Start here: define who may install software and how it is approved.
Purpose
Control software installation on live systems.
Requirement
Requirement summaryProcedures and measures shall be implemented to securely manage software installation on operational systems.
Why it matters
Uncontrolled software installation introduces malware and licence issues.
How to implement
- Define who may install software and how it is approved.
- Use allow-lists or managed app stores.
- Keep operational systems' software under change control.
- Remove unapproved software.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.19. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for approving software installation.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.19 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of approved software.
- Approval records for recent installs.
- Settings stopping ordinary users from installing software.
- Reports of unapproved software found and removed.
Things you should be able to show or explain
- Be able to show that a normal user can't install unapproved software.
How much to show: A handful of devices.
Common mistakes
- Users can install anything.
- No approved software list.
- Everyone has local admin rights.
- Installing unvetted packages on production servers.
- Tip: Allow-list approved software.
Policies & documents to have
- Information Security Policy
- Operations Security Policy
FAQ
Is A.8.19 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.19?
Be ready to explain how the control works in your organisation and to provide things like: Your process for approving software installation…