NIST 800-171 Controls · Configuration Management

CM.2.009 — Control and Monitor User-Installed Software

CMMC Level 2SPRS if unmet: -3HIGH priority~5h to implement

Control and monitor user-installed software.

What CM.2.009 means in plain English

Even with the best policies, employees sometimes find ways to install software you did not approve—a browser extension, a PDF converter from a sketchy website, a remote access tool a vendor emailed them. You need both a technical control that prevents or alerts on unauthorized installs, AND a monitoring process where someone periodically checks what is actually installed across all machines against your approved software list. For an 8-person shop, a monthly 10-minute spot check of installed programs on each machine plus Event Viewer logs is sufficient.

The assessment question

“Is there a process in place to both technically control user-installed software and to periodically monitor systems to detect unauthorized software that may have been installed, with records of monitoring reviews?”

How to implement CM.2.009

Technical prevention: ensure all regular employee accounts are standard (non-admin) users—this is your first line of defense because standard users cannot install most software without administrator credentials. Verify this is in place per CM.2.005.
Configure Windows Event Auditing to capture software installation events: Event IDs 11707 (product installed), 11724 (product removed), and 1033/1034 (Windows Installer). Enable these by auditing Application log entries. This creates an automatic record of installation attempts.
Create a monthly "Software Spot Check" procedure: on the first Monday of each month, the IT-responsible person uses Programs and Features (or PowerShell: Get-WmiObject -Class Win32_Product) on at least 2-3 randomly selected machines to compare installed software against the approved software list. Document the check in a log: date, machines checked, findings, actions taken.
For Microsoft 365 environments: use Microsoft Intune (included in M365 Business Premium) to deploy and enforce approved app lists on managed devices. Intune can block sideloaded apps and report on installed software inventory automatically.
If unauthorized software is found: document it in the change log, remove it immediately, investigate how it was installed (check Event ID 4688 process creation logs), and retrain or counsel the employee involved.

Evidence your assessor will ask for

Monthly software spot-check log showing dates, machines checked, reviewer, and findings
Approved software list used as the baseline for comparison during spot checks
Windows Event Log excerpt showing software installation events are being captured
Evidence that standard users cannot self-install software (account type screenshots)
At least one documented example of unauthorized software being found, removed, and investigated

Does AI prompt monitoring help with this control? Honestly, no.

CM.2.009 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Configuration Management controls

CM.2.001

Establish and Maintain Baseline Configurations

CM.2.002

Establish and Enforce Security Configuration Settings

CM.2.003

Track, Review, Approve, and Log Changes to Systems

CM.2.004

Analyze Security Impact of Changes Prior to Implementation

CM.2.005

Define and Enforce Access Restrictions for Configuration Changes

CM.2.006

Employ Principle of Least Functionality

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment