Control A.8.19Installation of software on operational systems
What it means in practice
Procedures and measures must be implemented to securely manage software installation on operational systems.
The control governs what may be installed on running systems, by whom, and through what process — which is both an integrity control and a licensing one under A.5.32.
The expectations are that installation is authorised, that software comes from sources the organisation trusts, that its integrity is verified, that previous versions are retained so a change can be rolled back, and that what is installed is recorded so A.8.8’s vulnerability evaluation knows what exists.
Application control — permitting only approved software to execute — is the strongest form and the hardest to operate, because exceptions accumulate and each one is granted under pressure.
The gap that persists in most estates is the software installed outside the process: developer tooling, browser extensions, agents bundled with something else, and utilities added during an incident and never removed. Each is unmanaged code on a managed system.
How to put this in place
Uncontrolled software on production systems brings vulnerabilities, malware and instability. Your ISMS needs a simple, controlled route for getting software onto live systems.
- Decide who may install software on workstations and on servers.
- Remove local administrator rights from ordinary users.
- Set up an approved catalogue and a simple request route for anything else.
- Use application allow-listing on servers and critical systems where feasible.
- Tie installs on production systems to change records, and review installed software periodically.
Evidence an auditor usually looks for: installation rights settings, the software catalogue or allow-list, and requests with approvals.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Patch Management Standard
in Patch ManagementIts Framework References list this control. Supported by: PM-04 to PM-09: patches installed on operational systems from trusted sources, tested, in rings and windows. - Word
Monthly Patch Cycle Operating Procedure
in Patch ManagementIts Framework References list this control. Supported by: CY-03 to CY-08: installing patches on operational systems in rings and windows.