NIST Guidance

NIST 800-53, SA-6 states that software and associated documentation must be used in accordance with contract agreements and copyright laws. For software and associated documentation protected by quantity licenses, the organization employs tracking systems to control copying and distribution. The organization controls and documents the use of publicly accessible peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

SA-7 adds that if provided the necessary privileges, users have the ability to download and install software. The organization should identify what types of software downloads and installations are permitted (e.g., updates and security patches to existing software) and what types of downloads and installations are prohibited (e.g., software that is free only for personal, not government, use). The organization should also restrict the use of install-on-demand software.