Control A.8.19Installation of software on operational systems
Procedures and measures must be implemented to securely manage software installation on operational systems.
The control governs what may be installed on running systems, by whom, and through what process — which is both an integrity control and a licensing one under A.5.32.
The expectations are that installation is authorised, that software comes from sources the organisation trusts, that its integrity is verified, that previous versions are retained so a change can be rolled back, and that what is installed is recorded so A.8.8’s vulnerability evaluation knows what exists.
Application control — permitting only approved software to execute — is the strongest form and the hardest to operate, because exceptions accumulate and each one is granted under pressure.
The gap that persists in most estates is the software installed outside the process: developer tooling, browser extensions, agents bundled with something else, and utilities added during an incident and never removed. Each is unmanaged code on a managed system.
How to put this in place
Uncontrolled software on production systems brings vulnerabilities, malware and instability. Your ISMS needs a simple, controlled route for getting software onto live systems.
- Decide who may install software on workstations and on servers.
- Remove local administrator rights from ordinary users.
- Set up an approved catalogue and a simple request route for anything else.
- Use application allow-listing on servers and critical systems where feasible.
- Tie installs on production systems to change records, and review installed software periodically.
Evidence an auditor usually looks for: installation rights settings, the software catalogue or allow-list, and requests with approvals.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.