ISO 27001 A.8.19: Installation of software on operational systems

Put a software management policy in place that spells out who can install software, what is approved, how new requests are handled, and what technical controls enforce the rules. Remove local administrator rights from standard users. Set up a software request and approval process through your IT service desk. Build a self-service catalogue of pre-approved applications so people are not constantly raising tickets for common tools. Anything outside the catalogue goes through a formal request, security review, and sign-off. Deploy software through managed channels only. Use enterprise distribution tools (SCCM, Intune, Jamf, Ansible) to push approved software consistently. Maintain a repository of tested, approved versions and use package signing to verify integrity before installation. On critical systems, implement application whitelisting. Technologies like Windows Defender Application Control (WDAC), AppLocker, or third-party tools can restrict execution to approved software only. Start in audit mode to catch all legitimate applications, then switch to enforcement. This is especially important for servers. Before approving any new software, run a security review. Check for known vulnerabilities, look at the vendor's security track record, assess what privileges it needs, and evaluate what data it accesses or sends externally. Do not skip open-source components. Keep a live inventory of all installed software using automated discovery. Reconcile it against your approved list regularly. Investigate and remove anything unauthorised. Track versions to support both vulnerability management and licence compliance. Funnel software updates through your patch management process. Test before deploying, push updates within defined timeframes based on criticality, and retire anything that has hit end-of-life without security patch support.