#iso27002/2022/EN
## 8.19 Installation of software on operational systems

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities                    | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | ------------------------------------------- | ---------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Protect               | #Secure_configuration #Application_security | #Protection      |

**Control**
Procedures and measures should be implemented to securely manage software installation on operational systems.

**Purpose**
To ensure the integrity of operational systems and prevent exploitation of technical vulnerabilities.

**Guidance**
The following guidelines should be considered to securely manage changes and installation of software on operational systems:

a\) performing updates of operational software only by trained administrators upon appropriate management authorization (see [8.5](a-8.5-Secure-authentication.md));

b\) ensuring that only approved executable code and no development code or compilers is installed on operational systems;

c\) only installing and updating software after extensive and successful testing (see >8.29 and >8.31>);

d\) updating all corresponding program source libraries;

e\) using a configuration control system to keep control of all operational software as well as the system documentation;

f\) defining a rollback strategy before changes are implemented;

g\) maintaining an audit log of all updates to operational software;

h\) archiving old versions of software, together with all required information and parameters, procedures, configuration details and supporting software as a contingency measure, and for as long as the software is required to read or process archived data.

Any decision to upgrade to a new release should take into account the business requirements for the change and the security of the release (e.g. the introduction of new information security functionality or the number and severity of information security vulnerabilities affecting the current version). Software patches should be applied when they can help to remove or reduce information security vulnerabilities (see >8.8and >8.19>).

Computer software can rely on externally supplied software and packages (e.g. software programs using modules which are hosted on external sites), which should be monitored and controlled to avoid unauthorized changes, because they can introduce information security vulnerabilities.

Vendor supplied software used in operational systems should be maintained at a level supported by the supplier. Over time, software vendors will cease to support older versions of software. The organization should consider the risks of relying on unsupported software. Open source software used in operational systems should be maintained to the latest appropriate release of the software. Over time, open source code can cease to be maintained but is still available in an open source software repository. The organization should also consider the risks of relying on unmaintained open source software when used in operational systems.

When suppliers are involved in installing or updating software, physical or logical access should only be given when necessary and with appropriate authorization. The supplier’s activities should be monitored (see [5.22](a-5.22-Monitoring-review-and-change-management-of-supplier-services.md)).

The organization should define and enforce strict rules on which types of software users can install.

The principle of least privilege should be applied to software installation on operational systems. The organization should identify what types of software installations are permitted (e.g. updates and security patches to existing software) and what types of installations are prohibited (e.g. software that is only for personal use and software whose pedigree with regard to being potentially malicious is unknown or suspect). These privileges should be granted based on the roles of the users concerned.

**Other information**
No other information.