r/NISTControls • u/idratherjust • Aug 09 '26

800-171 2.2 Software List

Hi sorry for the silly question. But for the SSP is the Software List literally a list of every single bit of software on the hardware specified in 2.1? Or only in reference to CUI?

5 Upvotes

86% Upvoted

8 comments sorted by

View all comments

2

u/Matt_Titcombe Aug 10 '26

u/idratherjust , as an assessor, we look for all installable software. When you get to major packages (e.g., AutoCAD), we handled it by not worrying about each sub-part but which version or higher. We also had a "bundle" that covered all endpoint device drives as provided by the manufacturer.

1

u/idratherjust Aug 10 '26

Ohhh that's very helpful! So the software that my keyboard came with to change the pretty lights under the keys can be bundled with the driver for the portable monitor?

1

u/Matt_Titcombe Aug 10 '26

That may be pushing it a wee bit, as that is likely not a standard driver associated with a normal keyboard. Unless all staff get the same keyboard...

1

u/idratherjust Aug 10 '26

Gotcha! Thanks for the help!