Software Inventory

Software Inventory A. Each agency must maintain an up-to-date list of all authorized software that is required for any agency purpose on any agency system. 1. Implement a process that requires approval before new software is installed or deployed. 2. Software platform and application inventory shall be maintained and updated throughout the asset’s lifecycle (installations, removals, updates, etc.). B. Each agency must ensure that software, applications, or operating systems that have reached EOL and are no longer supported are replaced with alternatives which are supported by its respective vendor. This does not apply to in-house software development unless third-party tools or components are included within its design or functionality. 1. Unsupported software should be removed from the authorized software inventory system or at least "No longer authorized for use on agency systems". C. Each agency must ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. This should be reviewed on a regular basis, or at least monthly. D. ITS recommends utilizing software inventory tools throughout the agency to automate the documentation of all software on agency systems. 1. The software inventory system should track the name, version, publisher, and install date for all software, including operating systems authorized by the agency. E. ITS recommends utilizing technical controls, such as application allowlisting (application control), to ensure that only authorized software can execute or be accessed. The functionality of these controls should be reviewed bi-annually, at minimum. F. ITS recommends utilizing technical controls to ensure that only authorized software libraries (such as .dell,, .ocx,, .so files) are allowed to load into a system process. Block unauthorized libraries from loading into a system process. The functionality of these controls should be reviewed bi-annually, at minimum.