NIST 800-171 3.4.9Control and monitor user-installed software
Overview
This control requires organizations to control and monitor user-installed software. It is part of the Configuration Management family and is required for CMMC Level 2 certification. Defense contractors handling CUI must implement this control to protect sensitive information and demonstrate compliance during assessments.
Assessment Objectives
- 1Determine if the organization has defined policies and procedures to control and monitor user-installed software
- 2Determine if the organization implements mechanisms to control and monitor user-installed software
- 3Verify that the implementation is consistent with organizational policies and NIST 800-171 requirements
Implementation Guidance
Implement this control by establishing documented policies and procedures, deploying appropriate technical controls, and maintaining evidence of ongoing compliance. Regularly review and test the implementation to ensure effectiveness and address any gaps identified during assessments.
Common Audit Gaps
Related DFARS Clauses
Frequently Asked Questions
What is NIST 800-171 control 3.4.9?
NIST 800-171 control 3.4.9 requires organizations to control and monitor user-installed software. This control is part of the Configuration Management family and is required for CMMC Level 2 certification.
How do you implement NIST 800-171 3.4.9?
To implement control 3.4.9, establish documented policies, deploy technical controls to control and monitor user-installed software, and maintain evidence of compliance. Regular testing and monitoring are essential.
What evidence is needed for NIST 800-171 3.4.9?
Evidence for control 3.4.9 typically includes written policies and procedures, system configuration documentation, audit logs showing enforcement, and records of periodic reviews. Assessors will look for both documentation and technical implementation.
Related Controls
3.4.8|Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software
Configuration Management
3.11.1|Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI
Risk Assessment
More in Configuration Management
Related Guides
Free Compliance Tools
Check your compliance for 3.4.9
Run our free CUI Auditor to see if your tools meet this control's requirements.
Audit Your Tech Stack FreeTrack NIST 800-171 3.4.9 regulatory updates with AI-powered intelligence
Signals matches SAM.gov opportunities to your profile, monitors regulatory changes, and alerts you before competitors. Free for 90 days.
Start Free — 90 DaysDiscussion
Share your experience implementing this in your organization.
Join the Club to unlock joining discussions
Free membership — access intelligence, save your work, and more.
Create free account