Unauthorized Software — Deny-by-exception (CM-7(4))

Identify [organization-defined]; Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and Review and update the list of unauthorized software programs [organization-defined].