CM-10 Software usage restrictions
Requires software and its documentation to be used within contract and copyright terms, use of quantity licensed software to be tracked so copying and distribution stay controlled, and peer to peer file sharing to be con
4
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of tracking for quantity licensed products · Cloud console / configuration management
- Attestation or audit result showing use within contract terms · Vendor register / contract repository
governing documentDocuments that govern the control
- Software licence register reconciled to deployed installations · Policy repository / GRC workspace
- Policy and technical control record covering peer to peer file sharing · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Licence counts tracked in finance records that never reconcile to actual installations
- Open source obligations ignored because only paid licences are tracked
- Peer to peer controls absent on developer workstations and build servers
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCM-9 Configuration management plan · CM-11 User-installed software