CM.L2-3.4.9
User-Installed Software
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.9 in the reference catalog with its NIST cross-references
Official requirement
Control and monitor user-installed software.
Assessment objectives
a. a policy for controlling the installation of software by users is established;
b. installation of software by users is controlled based on the established policy; and
c. installation of software by users is monitored.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control and monitor software installed by users.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator. A user calls you for help installing a software package. They are receiving a message asking for a password because they do not have permission to install the software. You explain that the policy prohibits users from installing software without approval [a]. When you set up workstations for users, you do not provide administrative privileges. After the call, you redistribute the policy to all users ensuring everyone in the company is aware of the restrictions.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing user installed software; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; list of rules governing user- installed software; system monitoring records; system audit logs and records; continuous monitoring strategy; other relevant documents or records
Common mistakes
Assuming removal of local administrator rights addresses every installation method.