Overview
CSC V8 control 2.2 recommends that organisations “Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterprise’s mission, document an exception detailing mitigating controls and residual risk acceptance. For any unsupported software without an exception documentation, designate as unauthorized. Review the software list to verify software support at least monthly, or more frequently.”.
Note
CSC V8 places this control in the category of “Inventory and Control of Software Assets”.
CSC V8 places this control in the function of “Identify”.
This control protects the following type of asset “Applications”.
What is CIS Critical Security Controls?
The CIS Controls (formerly known as Critical Security Controls) are a recommended set of actions for cyber defense that provide specific and actionable ways to protect against cyber attacks.
The Center for Internet Security (CIS) publishes the CIS Critical Security Controls (CSC) to help organizations better defend against known attacks by distilling key security concepts into actionable controls to achieve greater overall cybersecurity defense.