CM.L2-3.4.8

Application Execution Policy

Source and approval

CMMC Assessment Guide — Level 2 · Revision 2.13

Publisher approved · Complete cited source edition 2026-10-31

See CM.L2-3.4.8 in the reference catalog with its NIST cross-references

Official requirement

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

Assessment objectives

a. a policy specifying whether whitelisting or blacklisting is to be implemented is specified;

b. the software allowed to execute under whitelisting or denied use under blacklisting is specified; and

c. whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.

Implementation guidance

Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.

In plain language

Control application execution through an authorized allowlist or denylist policy.

Implementation example

Example from the source assessment guide (not a mandatory implementation): To improve your company’s protection from malware, you have decided to allow only designated programs to run. With additional research you identify a capability within the latest operating system that can control executables, scripts, libraries, or application installers run in your environment [c]. To ensure success you begin by authorizing digitally signed executables. Once they are deployed, you then plan to evaluate and deploy whitelisting for software libraries and scripts [c].

Evidence examples

Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing least functionality in the system; system security plan; configuration management plan; system design documentation; system configuration settings and associated documentation; list of software programs not authorized to execute on the system; list of software programs authorized to execute on the system; security configuration checklists; review and update records associated with list of authorized or unauthorized software programs; change control records; system audit logs and records; other relevant documents or records

Common mistakes

Maintaining a software list without enforcing what may actually execute.

Apply this in your workspace →