Authorized Software — Allow-by-exception

frameworkNIST SP 800-53 Rev 5.2 sectionCM Configuration Management csf 2.0PR.PS-05 topicsEndpoint Protection frameworks6 4 3

Official text(a) Identify [Assignment: organization-defined software programs];
(b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
(c) Review and update the list of authorized software programs [Assignment: organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of CM-7(5) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-09 PR.PS-05	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events; Installation and execution of unauthorized software are prevented	Crosswalk	Same topic: Endpoint Protection
ISO 27001	A.8.19 A.8.1 A.8.7	Installation of software on operational systems; User endpoint devices…	Crosswalk	Same topic: Endpoint Protection
CIS v8.1	CIS 2.5 CIS 10.1 CIS 2.6 CIS 2.7 CIS 10.2 CIS 10.3 CIS 10.4 CIS 10.5 CIS 10.6 CIS 10.7	Allowlist Authorized Software; Deploy and Maintain Anti-Malware Software…	Crosswalk	Same topic: Endpoint Protection
SOC 2	CC6.8	Preventing or detecting unauthorized or malicious software	Editorial	Same topic: Endpoint Protection (editorial pick)
PCI DSS	5.2.1 5.2.2 5.3.2	Anti-malware deployed on system components; Anti-malware detects, removes or contains known malware…	Crosswalk	Same topic: Endpoint Protection 2 loosely related (not mappings) 2.2.1 System configuration standards developed and maintained Loosely related Only shares CSF PR.PS-05: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF PR.PS-05: related, not a mapping
CMMC	SI.L2-3.14.2 SI.L2-3.14.4 CM.L2-3.4.5 CM.L2-3.4.7 CM.L2-3.4.8 CM.L2-3.4.9	Malicious Code Protection; Update Malicious Code Protection…	Crosswalk	Same topic: Endpoint Protection (editorial pick) NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.04.08 → SP 800-53
HIPAA	§164.308(a)(5)(ii)(B)	Protection from Malicious Software	Editorial	Same topic: Endpoint Protection (editorial pick)
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.9	Protection against malicious and unauthorised software	Crosswalk	Same topic: Endpoint Protection 1 loosely related (not mappings) 6.7 Network security Loosely related Only shares CSF PR.PS-05: related, not a mapping
Essential Eight	ISM-0843 ISM-1488 ISM-1490 ISM-1544 ISM-1657 ISM-1870	Application control is implemented on workstations; Microsoft Office macros in files originating from the internet are blocked…	Editorial	Same topic: Endpoint Protection (editorial pick) 16 loosely related (not mappings) ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1582 Application control rulesets are validated at least annually Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1656 Application control is implemented on non-internet-facing servers Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1658 Application control restricts the execution of drivers to an organisation-approved set Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1659 Microsoft’s vulnerable driver blocklist is implemented Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Loosely related Only shares CSF PR.PS-05: related, not a mapping ISM-1671 Microsoft Office macros are disabled for human users that do not have a demonstrated… Loosely related Only shares CSF PR.PS-05: related, not a mapping …and 8 more in the downloads
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 5	Malware protection	Editorial	Same topic: Endpoint Protection (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.