CM-7(5) Authorized Software — Allow-by-exception

Family CM

Baselines moderate

Mapped KSIs 2

Control statement

(a) Identify {{ insert: param, cm-07.05_odp.01 }};
    (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
    (c) Review and update the list of authorized software programs {{ insert: param, cm-07.05_odp.02 }}.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSI	Title	Category
KSI-IAM-04	Just-in-Time Authorization Use a least-privileged, role and attribute-based, and just-in-time security authorization model for all user and non-user accounts and services.	Identity and Access Management
KSI-PIY-01	Automated Inventory Use authoritative sources to automatically generate real-time inventories of all information resources when needed.	Policy and Inventory