Establish and Maintain a Software Inventory
Description
Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software inventory must document the title, publisher, initial install/use date, and business purpose for each entry; where appropriate, include the Uniform Resource Locator (URL), app store(s), version(s), deployment mechanism, and decommission date. Review and update the software inventory bi-annually, or more frequently.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
IT asset management and software asset management platform with license optimization and SaaS management
Flexera · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Supply Chain Compromise via Untracked Software
IntegrityMalicious or backdoored software installed without inventory tracking evades security review, enabling supply chain attacks like those seen in SolarWinds-type compromises.
License Compliance Exploitation
ConfidentialityUnlicensed or pirated software installed outside inventory controls introduces trojanized versions or cracks that contain embedded malware and credential stealers.
Abandoned Software as Attack Surface
IntegrityApplications installed for past projects but never inventoried remain on systems with known vulnerabilities, providing easy exploitation targets for attackers.
Vulnerabilities (When Safeguard Absent)
No Centralized Software Inventory
Without a maintained software inventory, the organization cannot determine what applications are installed across endpoints, leaving unknown software unpatched and unmonitored.
Inability to Verify Software Legitimacy
Without records of publisher, version, and business purpose, the organization cannot distinguish authorized software from unauthorized or malicious installations.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Technical | Asset/software inventory export with required fields populated | Exported quarterly for review |
| Record | Inventory review meeting minutes or sign-off | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |