CM-07(02) Prevent Program Execution
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Prevent Program Execution
Control
Prevent program execution in accordance with [Selection (one or more): {{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage].
Discussion
Prevention of program execution addresses organizational policies, rules of behavior, and/or access agreements that restrict software usage and the terms and conditions imposed by the developer or manufacturer, including software licensing and copyrights. Restrictions include prohibiting auto-execute features, restricting roles allowed to approve program execution, permitting or prohibiting specific software programs, or restricting the number of program instances executed at the same time.
Parameters
cm-07.02_odp.01: [{{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage]
cm-07.02_odp.02: policies, rules of behavior, and/or access agreements regarding software program usage and restrictions
Related controls
cm-8, pl-4, pl-9, pm-5, ps-6
Assessment objective
CM-07(02) program execution is prevented in accordance with [Selection (one or more): {{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage].
STIG rules that implement this control 66
Application Security and Development V6R5
- APSC-DV-001480 CAT II The application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-431010 CAT II Ubuntu 22.04 LTS must have the "apparmor" package installed.
- UBTU-22-431015 CAT II Ubuntu 22.04 LTS must be configured to use AppArmor.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100500 CAT II Ubuntu 24.04 LTS must have AppArmor installed.
- UBTU-24-100510 CAT II Ubuntu 24.04 LTS must be configured to use AppArmor.
Google Android 16 COBO Y26M10
- GOOG-16-006600 CAT II Google Android 16 must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].
Google Android 17 COBO Y26M06
- GOOG-17-005500 CAT II Google Android 17 must be configured to enforce an application installation policy by specifying an application allow list that restricts applications by the following characteristics: [selection: list of digital signatures, cryptographic hash values, names, application version].
Microsoft Windows 11 V2R11
- WN11-CC-000180 CAT I Autoplay must be turned off for non-volume devices.
- WN11-CC-000185 CAT I The default autorun behavior must be configured to prevent autorun commands.
- WN11-CC-000190 CAT I Autoplay must be disabled for all drives.
Microsoft Windows Server 2022 V2R11
- WN22-CC-000210 CAT I Windows Server 2022 Autoplay must be turned off for nonvolume devices.
- WN22-CC-000220 CAT I Windows Server 2022 default AutoRun behavior must be configured to prevent AutoRun commands.
- WN22-CC-000230 CAT I Windows Server 2022 AutoPlay must be disabled for all drives.
Microsoft Windows Server 2025 V1R4
- WN25-CC-000210 CAT I Windows Server 2025 AutoPlay must be turned off for nonvolume devices.
- WN25-CC-000220 CAT I Windows Server 2025 default AutoRun behavior must be configured to prevent AutoRun commands.
- WN25-CC-000230 CAT I Windows Server 2025 AutoPlay must be disabled for all drives.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200600 CAT II RHEL 10 must have the "fapolicy" module installed.
- RHEL-10-200601 CAT II RHEL 10 must enable the "fapolicy" module.
- RHEL-10-200602 CAT II RHEL 10 must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
- RHEL-10-400355 CAT II RHEL 10 must prevent device files from being interpreted on file systems that contain user home directories.
- RHEL-10-400360 CAT II RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on file systems that contain user home directories.
- RHEL-10-400400 CAT II RHEL 10 must mount "/var/log/audit" with the "nodev" option.
- RHEL-10-400405 CAT II RHEL 10 must mount "/var/log/audit" with the "noexec" option.
- RHEL-10-400410 CAT II RHEL 10 must mount "/var/log/audit" with the "nosuid" option.
- RHEL-10-700120 CAT II RHEL 10 must mount "/boot" with the "nodev" option.
- RHEL-10-700125 CAT II RHEL 10 must prevent files with the "setuid" and "setgid" bit set from being executed on the "/boot" directory.
- RHEL-10-700135 CAT II RHEL 10 must mount "/dev/shm" with the "nodev" option.
- RHEL-10-700140 CAT II RHEL 10 must mount "/dev/shm" with the "noexec" option.
- RHEL-10-700145 CAT II RHEL 10 must mount "/dev/shm" with the "nosuid" option.
- RHEL-10-700150 CAT II RHEL 10 must mount "/tmp" with the "nodev" option.
- RHEL-10-700155 CAT II RHEL 10 must mount "/tmp" with the "noexec" option.
- RHEL-10-700160 CAT II RHEL 10 must mount "/tmp" with the "nosuid" option.
- RHEL-10-700165 CAT II RHEL 10 must mount "/var" with the "nodev" option.
- RHEL-10-700170 CAT II RHEL 10 must mount "/var/log" with the "nodev" option.
- RHEL-10-700175 CAT II RHEL 10 must mount "/var/log" with the "noexec" option.
- RHEL-10-700180 CAT II RHEL 10 must mount "/var/log" with the "nosuid" option.
- RHEL-10-700185 CAT II RHEL 10 must mount "/var/tmp" with the "nodev" option.
- RHEL-10-700190 CAT II RHEL 10 must mount "/var/tmp" with the "noexec" option.
- RHEL-10-700195 CAT II RHEL 10 must mount "/var/tmp" with the "nosuid" option.
- RHEL-10-700200 CAT II RHEL 10 must prevent special devices on nonroot local partitions.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-231045 CAT II RHEL 9 must prevent device files from being interpreted on file systems that contain user home directories.
- RHEL-09-231050 CAT II RHEL 9 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories.
- RHEL-09-231095 CAT II RHEL 9 must mount /boot with the nodev option.
- RHEL-09-231100 CAT II RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot directory.
- RHEL-09-231105 CAT II RHEL 9 must prevent files with the setuid and setgid bit set from being executed on the /boot/efi directory.
- RHEL-09-231110 CAT II RHEL 9 must mount /dev/shm with the nodev option.
- RHEL-09-231115 CAT II RHEL 9 must mount /dev/shm with the noexec option.
- RHEL-09-231120 CAT II RHEL 9 must mount /dev/shm with the nosuid option.
- RHEL-09-231125 CAT II RHEL 9 must mount /tmp with the nodev option.
- RHEL-09-231130 CAT II RHEL 9 must mount /tmp with the noexec option.
- RHEL-09-231135 CAT II RHEL 9 must mount /tmp with the nosuid option.
- RHEL-09-231140 CAT II RHEL 9 must mount /var with the nodev option.
- RHEL-09-231145 CAT II RHEL 9 must mount /var/log with the nodev option.
- RHEL-09-231150 CAT II RHEL 9 must mount /var/log with the noexec option.
- RHEL-09-231155 CAT II RHEL 9 must mount /var/log with the nosuid option.
- RHEL-09-231160 CAT II RHEL 9 must mount /var/log/audit with the nodev option.
- RHEL-09-231165 CAT II RHEL 9 must mount /var/log/audit with the noexec option.
- RHEL-09-231170 CAT II RHEL 9 must mount /var/log/audit with the nosuid option.
- RHEL-09-231175 CAT II RHEL 9 must mount /var/tmp with the nodev option.
- RHEL-09-231180 CAT II RHEL 9 must mount /var/tmp with the noexec option.
- RHEL-09-231185 CAT II RHEL 9 must mount /var/tmp with the nosuid option.
- RHEL-09-271030 CAT II RHEL 9 must disable the graphical user interface autorun function unless required.
- RHEL-09-433010 CAT II RHEL 9 fapolicy module must be installed.
- RHEL-09-433015 CAT II RHEL 9 fapolicy module must be enabled.
- RHEL-09-433016 CAT II The RHEL 9 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
Samsung Android 16 COBO Y26M10
- KNOX-16-005500 CAT II Samsung Android's Work profile must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: Names.