A.8.19 Technological
Installation of software on operational systems
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (13)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CM-3mostlyaligns with — Both controls establish formal change-control procedures for software on operational systems, including authorization, testing, rollback planning, and audit logging of updates.
- CM-5mostlyaligns with — Both controls restrict who may install or modify software on operational systems and enforce least-privilege principles for those changes.
- AU-2partialaligns with — Both controls require logging of software installation and update events to support accountability and post-change review.
- CM-2partialaligns with — Both controls require maintaining an authoritative, version-controlled baseline of approved operational software and associated documentation.
- CM-6partialaligns with — Both controls ensure that only approved, hardened configurations and executables are deployed and that deviations are prevented or detected.
- SI-2partialaligns with — Both controls mandate timely application of security patches and updates after testing, while tracking vulnerabilities that the patches address.
Aligned NIST CSF 2.0 outcomes (13)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.PS-02fullcovers — The ISO control's emphasis on authorized, tested, and logged software updates directly fulfills the CSF outcome of maintaining, replacing, and removing software commensurate with risk.
- PR.PS-01mostlycovers — Requiring configuration control systems, rollback strategies, and audit logs for operational software changes implements the CSF outcome of establishing and applying configuration management practices.
- PR.PS-05mostlyaligns with — Enforcing strict rules on permitted versus prohibited software installations and applying least privilege prevents unauthorized software execution on operational systems.
- DE.CM-09partialaligns with — Maintaining audit logs of software updates and monitoring externally supplied software supports continuous monitoring of computing environments for adverse events.
- GV.SC-05partialaligns with — Requiring authorization and monitoring when suppliers install or update software integrates cybersecurity requirements into third-party contracts and activities.
- ID.RA-07partialaligns with — Assessing the security impact of new releases and patches before deployment aligns with managing changes and exceptions for risk impact.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V15.2.1mostlyaligns with — The ISO control's requirement to apply only tested, approved updates and patches to operational systems directly supports the ASVS rule that production components must remain within documented remediation timeframes and not contain known vulnerable versions.
- V13.3.4partialaligns with — Mandating a rollback strategy, audit logging, and archiving of prior versions before changes are applied corresponds to the ASVS requirement that secrets and critical configuration items be rotated and version-controlled according to documented schedules.
- V13.4.2partialaligns with — The prohibition on installing development code or compilers on operational systems and the insistence on least-privilege installation rights help ensure that debug or extraneous functionality is not present in production, matching the ASVS control that debug modes must be disabled.
- V15.2.4partialaligns with — Requiring that vendor and open-source software be maintained at supported releases and monitored for unauthorized changes aligns with the ASVS expectation that third-party components and transitive dependencies come from expected, controlled repositories.
- V15.2.5partialaligns with — Defining strict rules on permitted versus prohibited software types and applying least privilege to installation activities aligns with the ASVS requirement to implement additional protections around documented dangerous functionality.
Related weaknesses / CWE (42)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-114partialprevents — Restricting software installation prevents loading untrusted libraries or executing commands from unknown sources.
- CWE-1342partialmitigates — Software installation control can ensure only patched microcode or firmware is deployed.
- CWE-1357partialmitigates — Software-installation controls reduce risk of introducing untrusted components into production.
- CWE-1394partialprevents — Controls software installation and configuration, reducing risk of default keys being left in place.
- CWE-15partialmitigates — Restricting software installation limits unauthorized changes to configuration.
- CWE-284partialprevents — Requiring management authorization and least-privilege assignment for software installation directly blocks unauthorized actors from placing or altering code on operational systems.
- CWE-427partialmitigates — Restricting software installation reduces the chance that an attacker-controlled path element is introduced into the search path.
- CWE-507partialprevents — Controlling software installation prevents covert insertion of Trojan Horse payloads.
- CWE-508partialprevents — Restricting software installation reduces the chance of introducing non-replicating malicious code.
- CWE-509partialprevents — Restricts unauthorized software installation that could introduce replicating malware.
- CWE-553partialprevents — Restricting software installation prevents unauthorized shell scripts from being placed in web-accessible directories.
- CWE-732partialprevents — Enforcing strict rules on permitted software types and applying least privilege limits the permissions granted to users or processes that could otherwise modify critical resources.
- CWE-1269nonenone — Controlling software installation on operational systems reduces the chance that pre-production builds reach production.
- CWE-1310nonenone — Controlled software installation procedures can include firmware updates but do not guarantee ROM patchability.
- CWE-1328nonemitigates — Controlled software installation procedures can block unauthorized or older firmware versions from being loaded.
- CWE-1329nonenone — Software-installation rules can prevent deployment of non-updateable components, but do not mitigate the weakness once the component is already in use.
- CWE-242nonenone — Controlled software installation reduces exposure to unsafe third-party code containing dangerous functions.
- CWE-250noneprevents — Restricting installation privileges to trained administrators and denying them to ordinary users prevents processes from executing with unnecessary elevated rights.
- CWE-269nonenone — Granting software-installation rights only according to defined roles stops the assignment of excessive privileges that could be abused to introduce or alter code.
- CWE-426nonenone — Restricting software installation reduces the chance that untrusted binaries or libraries are placed in search paths.
- CWE-428nonenone — Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
- CWE-506nonenone — Banning unapproved or unknown software and requiring testing plus authorization reduces the chance that hidden malicious code will be introduced into production environments.
- CWE-556nonenone — Software installation procedures can enforce least-privilege configuration settings that avoid identity impersonation.
- CWE-623nonenone — Strict control over software installation prevents unsafe ActiveX controls from being deployed or marked safe-for-scripting.
- CWE-64nonenone — Restricting software installation can limit introduction of malicious .LNK files but does not address handling of shortcuts already present.
- CWE-646nonenone — Restricting software installation can limit dangerous file types but does not enforce content-based validation.
- CWE-676nonenone — Controlled software installation reduces exposure to unsafe third-party libraries that may contain dangerous calls.
- CWE-695nonenone — Software installation controls limit unapproved components but not low-level API usage inside code.
- CWE-798nonenone — Mandating only approved, tested releases from supported vendors lowers the likelihood that hard-coded credentials will be shipped inside unvetted or outdated software packages.
Mitigated MITRE ATT&CK techniques (6)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1505mostlyprevents — Enforcing strict rules on permitted software types and prohibiting unapproved or unknown software reduces the chance that an adversary can install web shells or other server software components for persistence.
- T1554mostlyprevents — Controlling which software may be installed and maintaining an audit log of changes hinders an adversary’s ability to compromise host software binaries without leaving detectable traces.
- T1072partialmitigates — Restricting software installation and updates to authorized administrators and enforcing least privilege prevents adversaries from leveraging software deployment or update tools to execute code across the environment.
- T1195partialprevents — Requiring management authorization, trained administrators, and testing before software is installed on operational systems reduces the likelihood that an adversary can introduce malicious code through a compromised supply chain or vendor update.
- T1543partialmitigates — Requiring authorization, testing, and configuration control before installing or updating software makes it harder for an adversary to create or modify system processes or services for persistence.
- T1053nonemitigates — Mandating configuration control, rollback planning, and audit logging for all software changes limits an adversary’s ability to create or modify scheduled tasks or jobs without detection.
Prevented OWASP Web Top 10 (2025) risks (5)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02mostlyprevents — Requiring management authorization, testing, configuration control, and rollback procedures before any software change on production systems directly stops the introduction of insecure defaults, untested patches, or unauthorized binaries that create misconfigurations.
- A03mostlyprevents — Mandating supplier monitoring, supported-version maintenance, and pedigree checks for both commercial and open-source components reduces the chance that compromised or unmaintained third-party code enters the running environment.
- A08mostlyprevents — Archiving prior versions, maintaining audit logs, and enforcing rollback strategies limit the blast radius when an update introduces integrity issues or when malicious code is later discovered in deployed software.
- A01noneprevents — Applying least privilege to software-installation rights and restricting which users or roles may install or update code prevents unauthorized elevation of privileges through rogue or malicious executables.
- A09nonemitigates — Requiring an audit log of every software update on operational systems provides the visibility needed to detect and investigate integrity or configuration changes after the fact.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.