Software management

Organisation should:

• Identify and list the types of software to be managed, including firmware, operating systems, applications, libraries, and device drivers.
• Ensure that repositories for managed software are created and maintained.
• Implement security measures to protect the software repositories from unauthorized access and manipulation.
• Conduct regular reviews to ensure that all software in use remains approved and meets the organization’s security and operational standards.
• Keep an updated record of all software versions and their respective patch levels to ensure that all software is up-to-date and secure.

Unmanaged installations of software on computers can lead to vulnerabilities and security breaches.

The organization should determine what types of software or updates each user can install. The instructions may include e.g. the following guidelines:

• only specially designated persons may install new software on the devices
• programs previously designated as secure may be installed by anyone
• use of certain software may be impossible for everyone
• existing software updates and security patches are allowed to be installed by anyone

The organisation must make sure unnecessary software like application, system utilities and network services are removed.

Software updates should have a management process in place to ensure that the latest approved patches and application updates are installed on all approved software. Earlier versions of software should be retained as a precaution.