CM-10_software-usage-restrictions

CM-10 Software Usage Restrictions

High-Level Description

Family: Configuration Management (CM) Framework: NIST SP 800-53 Rev 5

Software license tracking can be accomplished by manual or automated methods, depending on organizational needs. Examples of contract agreements include software license agreements and non-disclosure agreements.

What to Check

• Verify CM-10 Software Usage Restrictions is documented in SSP
• Validate all 3 control requirements are implemented
• Confirm control is operating effectively
• Review evidence of continuous monitoring for CM-10

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for CM-10 implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Remediation Guide

Control Statement

Use software and associated documentation in accordance with contract agreements and copyright laws; Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Implementation Guidance

Software license tracking can be accomplished by manual or automated methods, depending on organizational needs. Examples of contract agreements include software license agreements and non-disclosure agreements.

Risk Assessment

CWE Categories

References

• NIST SP 800-53 Rev 5 - CM-10
• NIST SP 800-53A Rev 5 (Assessment Procedures)
• NIST SP 800-53 Rev 5 Full Catalog

Checklist

• Control documented in SSP
• Implementation evidence collected
• Operating effectiveness validated
• Continuous monitoring in place
• Related controls (AC-17, AU-6, CM-7, CM-8, PM-30) reviewed