Installation of software on operational systems
Plain English Translation
Organizations must establish strict rules governing how and when software is installed on live production servers, endpoints, and other operational systems. By implementing a clear software installation policy and leveraging change management for software deployment, organizations prevent the introduction of unapproved, vulnerable, or malicious applications. This typically involves utilizing application allowlisting and restricting administrative privileges to ensure only authorized personnel can deploy tested software.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Remove local administrator rights from standard user accounts to prevent unapproved installations.
- Implement basic endpoint antivirus to detect unauthorized application behavior.
Required Actions (scaleup)
- Deploy endpoint software deployment controls (e.g., SCCM or Intune) to centrally manage and approve applications.
- Require formal change management tickets before installing any new software on production servers.
Required Actions (enterprise)
- Enforce strict application whitelisting (allowlist/denylist) at the OS level.
- Automate all server software deployments via infrastructure-as-code pipelines integrated with ITIL change management workflows.
ISO 27001:2022 control A.8.19 is a technological control requiring organizations to implement strict measures governing how software is added to live environments. The ISO 27001 A.8.19 software installation control ensures that all software introduced to operational systems is authorized, tested, and does not negatively impact security or stability.
Before deployment, organizations must follow secure software installation procedures for production systems. This includes testing the software in an isolated sandbox, performing vulnerability scans, and obtaining formal approval through a software installation approval workflow ITIL change management process. WatchDog Security's Policy Management can help standardize the required SOPs, version control them, and record staff attestations to the installation procedure.
Knowing how to prevent unauthorized software installation on servers involves removing local administrator rights from everyday user accounts. Organizations must also deploy endpoint software deployment controls (SCCM/Intune) compliance tools to restrict installation capabilities strictly to authorized IT personnel.
Application whitelisting is a security practice that explicitly permits only approved software to run on a system, blocking all others by default. Creating an application control policy example (allowlist/denylist) directly supports ISO 27001 A.8.19 by providing an automated, technical enforcement layer against unauthorized installations.
Access should be restricted using the principle of least privilege for software installation admin rights. Only designated system administrators or automated deployment pipelines should have the necessary permissions to install or modify software on production operational systems.
Auditors will request a documented software installation policy, along with screenshots showing that standard users lack administrative rights to install applications. They will also look for evidence of logging and monitoring software installs on operational systems and approved change tickets for recent software deployments. WatchDog Security's Compliance Center can help organize these artifacts by control, highlight missing evidence, and maintain an audit trail for approvals and exceptions.
Effective change management for software deployment ensures that any new software is formally reviewed for security and operational risks before it goes live. Tying installations to change management prevents ad-hoc, undocumented changes that could lead to system outages or compliance breaches.
Organizations should centralize logs that record any successful or failed attempt to install, modify, or remove software. Continuous logging and monitoring software installs on operational systems allows security teams to quickly detect anomalous behavior, potential malware, or bypasses of the installation policy.
Emergency software installs, such as applying critical security patches, must follow an expedited emergency change management procedure. While the standard approval workflow is accelerated to mitigate immediate risk, the action must still be fully documented, restricted to authorized personnel, and logged for post-incident review.
A robust standard operating procedure for installing software on servers should detail the required testing phases, approval gates, and rollback plans. It should also include a standardized production environment software installation checklist to ensure engineers consistently verify system health and security before and after deployment.
The core requirement is consistent enforcement: approved software lists, restricted install privileges, and traceable approvals tied to changes. Tools like WatchDog Security's Compliance Center can help map A.8.19 requirements to evidence, track approval workflows, and keep an audit-ready record of installation controls and exceptions.
Start by defining risks (e.g., shadow IT, unpatched apps, privilege misuse), then track incidents, control gaps, and remediation owners with clear due dates. WatchDog Security's Risk Register supports risk scoring, treatment plans, and ongoing reporting so recurring installation issues are managed as measurable security risks, not one-off events.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-17 | WatchDog Security GRC Team | Initial publication |
