Use of approved software

Organisation has a process to review and approve software before installation or use. Process includes at least:

• Assess limited approval: Verifying if the software is approved for specific use-cases or roles within the organization.
• Check conformance: Ensuring the software meets the organization's information security requirements.
• Verify software use rights and licensing: Confirm that the software has the appropriate licensing for its intended use.
• Evaluate source and reputation: Assess the credibility and reputation of the software vendor or source.

This process should include the selection of special purpose software e.g. maintenance tools.

Organisation should:

• Identify and list the types of software to be managed, including firmware, operating systems, applications, libraries, and device drivers.
• Ensure that repositories for managed software are created and maintained.
• Implement security measures to protect the software repositories from unauthorized access and manipulation.
• Conduct regular reviews to ensure that all software in use remains approved and meets the organization’s security and operational standards.
• Keep an updated record of all software versions and their respective patch levels to ensure that all software is up-to-date and secure.