Profile Applicability:
 Level 1

Description:
 All software applications must undergo explicit approval by authorized administrators before installation on organizational devices or systems. This control prevents unauthorized or potentially harmful applications from being installed, reducing the risk of malware infections and policy violations.

Rationale:
 Requiring administrator approval enforces control over software deployment, mitigates risks from unapproved or malicious applications, and supports compliance with security policies and regulatory standards.

Impact:
 Pros:

  • Prevents unauthorized software installations.

  • Reduces risk of malware and vulnerabilities.

  • Enhances compliance with organizational policies.

  • Improves asset management and software inventory accuracy.

Cons:

  • May delay installation processes.

  • Requires clear approval workflows and documentation.

Default value:
 Some environments allow users to install applications without administrative oversight.

Audit:
 Review installation logs and approval records to confirm administrator authorization for all application installations.

Remediation:
 Implement policies and technical controls to enforce administrator approval before installations. Use endpoint management tools to restrict installation permissions. Train users and administrators on approval processes.

References:

  1.  https://www.cisecurity.org/controls/inventory-and-control-of-software-assets/

  2.  https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

  3. https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy