myctrl.tools
Compare

CM-7(2)—Prevent Program Execution

MODERATE
HIGH

>Control Description

Prevent program execution in accordance with ☑[Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage].

>Cross-Framework Mappings

SCF

CFG-03.2
Compare
SEA-06
Compare

>Programmatic Queries

Beta

Related Services

AWS AppConfig
AWS Systems Manager

CLI Commands

Create AppConfig configuration profile for program allowlist
aws appconfig create-configuration-profile --application-id myapp --name program-allowlist --location-uri hosted
Deploy allowlist configuration to instances
aws ssm send-command --document-name AWS-RunShellScript --instance-ids i-1234567890abcdef0 --parameters 'commands=["sudo /opt/scripts/apply-allowlist.sh"]' --region us-east-1
Get AppConfig deployment status
aws appconfig get-deployment --application-id myapp --environment-id myenv --deployment-number 1
Open AWS ConsoleDocumentation

>Supplemental Guidance

Prevention of program execution addresses organizational policies, rules of behavior, and/or access agreements that restrict software usage and the terms and conditions imposed by the developer or manufacturer, including software licensing and copyrights. Restrictions include prohibiting auto-execute features, restricting roles allowed to approve program execution, permitting or prohibiting specific software programs, or restricting the number of program instances executed at the same time.

>Related Controls

CM-8
PL-4
PL-9
PM-5
PS-6

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of CM-7(2) (Prevent Program Execution)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring CM-7(2)?
  • •How frequently is the CM-7(2) policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to CM-7(2)?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce CM-7(2) requirements.
  • •What automated tools, systems, or technologies are deployed to implement CM-7(2)?
  • •How is CM-7(2) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce CM-7(2) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of CM-7(2)?
  • •What audit logs, records, reports, or monitoring data validate CM-7(2) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of CM-7(2) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate CM-7(2) compliance?

Ask AI

Configure your API key to use AI features.