NIST 800-53 r5 · Controls catalogue · Family CM
CM-10Software Usage Restrictions
Use software and associated documentation in accordance with contract agreements and copyright laws; Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 2 mapping(s) from 1 framework(s): CSF 2.0 2 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (9)
- T1546.008 Accessibility Features Privilege Escalation, Persistence
- T1546.013 PowerShell Profile Privilege Escalation, Persistence
- T1550.001 Application Access Token Lateral Movement
- T1553 Subvert Trust Controls Defense Impairment
- T1553.004 Install Root Certificate Defense Impairment
- T1559 Inter-Process Communication Execution
- T1559.002 Dynamic Data Exchange Execution
- T1685 Disable or Modify Tools Defense Impairment
- T1688 Safe Mode Boot Defense Impairment
Weaknesses this control addresses (3)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-552 | Files or Directories Accessible to External Parties | 563 | Controlling and documenting P2P file sharing prevents files and directories from being made accessible to external parties for unauthorized distribution. |
CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 298 | Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres. |
CWE-506 | Embedded Malicious Code | 85 | Restricting software to licensed versions and controlling P2P prevents introduction of software containing embedded malicious code from unauthorized sources. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-41380 | 5.5 | 7.3 | 0.0012 | good |
CVE-2026-42778 | 7.0 | 9.8 | 0.0066 | good |
CVE-2026-32973 | 7.0 | 9.8 | 0.0041 | good |
CVE-2025-27105 | 7.0 | 9.1 | 0.0053 | good |
CVE-2026-28363 | 7.0 | 9.9 | 0.0050 | good |
CVE-2020-37181 | 7.0 | 9.8 | 0.0042 | good |
CVE-2022-50935 | 7.0 | 9.8 | 0.0036 | good |
CVE-2019-25268 | 7.0 | 9.8 | 0.0037 | good |
CVE-2025-49457 UPD | 7.0 | 9.6 | 0.0054 | good |
CVE-2026-35666 | 5.5 | 8.8 | 0.0037 | good |
CVE-2026-30478 | 5.5 | 8.8 | 0.0017 | good |
CVE-2026-32920 | 5.5 | 8.4 | 0.0033 | good |
CVE-2026-32172 | 5.5 | 8.0 | 0.0034 | good |
CVE-2026-42171 | 5.5 | 7.8 | 0.0021 | good |
CVE-2024-9157 | 5.5 | 7.8 | 0.0032 | good |
CVE-2021-47653 | 5.5 | 7.8 | 0.0025 | good |
CVE-2026-32015 | 5.5 | 7.8 | 0.0013 | good |
CVE-2024-53588 | 5.5 | 7.8 | 0.0019 | good |
CVE-2026-32016 | 5.5 | 7.8 | 0.0012 | good |
CVE-2026-32948 | 5.5 | 7.8 | 0.0030 | good |
CVE-2026-6594 | 5.5 | 7.3 | 0.0034 | good |
CVE-2025-26125 | 5.5 | 7.3 | 0.0048 | good |
CVE-2026-22175 | 5.5 | 7.1 | 0.0033 | good |
CVE-2026-35341 | 5.5 | 7.1 | 0.0016 | good |
CVE-2026-29610 | 5.5 | 8.8 | 0.0046 | good |