CM-11(02) Software Installation with Privileged Status
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Software Installation with Privileged Status
Control
Allow user installation of software only with explicit privileged status.
Discussion
Privileged status can be obtained, for example, by serving in the role of system administrator.
Related controls
ac-5, ac-6
Assessment objective
CM-11(02) user installation of software is allowed only with explicit privileged status.
STIG rules that implement this control 11
Apple macOS 15 (Sequoia) V1R8
- APPL-15-005080 CAT II The macOS system must prohibit user installation of software into /users/.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-005080 CAT II The macOS system must prohibit user installation of software into /users/.
Application Security and Development V6R5
- APSC-DV-001390 CAT II The application must prohibit user installation of software without explicit privileged status.
Microsoft Edge V2R5
- EDGE-00-000039 CAT III URLs must be allowlisted for plugin use if used.
Microsoft Windows 11 V2R11
- WN11-CC-000310 CAT II Users must be prevented from changing installation options.
- WN11-CC-000315 CAT I The Windows Installer feature "Always install with elevated privileges" must be disabled.
Microsoft Windows Server 2022 V2R11
- WN22-CC-000420 CAT II Windows Server 2022 must prevent users from changing installation options.
- WN22-CC-000430 CAT I Windows Server 2022 must disable the Windows Installer Always install with elevated privileges option.
Microsoft Windows Server 2025 V1R4
- WN25-CC-000420 CAT II Windows Server 2025 must prevent users from changing installation options.
- WN25-CC-000430 CAT I Windows Server 2025 must disable the Windows Installer Always install with elevated privileges option.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-600170 CAT II RHEL 10 must be configured so that all local interactive user initialization file executable search path statements do not contain statements that will reference a working directory other than user home directories.