This policy procedure sets out who can install software, how new and changed software is tested before release, and how software licences are kept in order.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on software installation and licensing:

• ISO 27001 Annex A 8.19 - Installation of Software on Operational Systems
• Malware, Anti-Malware and Patching
• ISO 27001 Annex A 5.32 - Intellectual Property Rights
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help setting up software approval and change control arrangements, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Software Policy Procedure Template

The Software Policy Procedure is a Word template that sets out how a business controls the software used and installed on its IT equipment and handheld devices. It covers software risk assessment, restricted admin rights, an approved software list, development and modification of software through a tested process, and licensing and intellectual property rights.

Changes to IT systems follow the change control procedure in the IMS1 manual. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of controlling software use and installation, the activities and staff covered, and disciplinary action for breaches
• Management of software risks - periodic risk assessments of the software used in the business, with findings actioned and the policy kept in line with current controls
• Control of operational software - admin rights limited to designated IT staff, software only from an approved list, patching, and security software never removed
• Development of software - a defined development process with testing, validation and approval, and sandbox testing before the live version is changed
• Modifications to software - changes planned and monitored through the IMS1 change control procedure and tested in a sandbox before release
• Intellectual property rights - all software licensed and used within the law on intellectual property, with licensed software patched and kept current

Built for Controlled Software Use

• Admin rights on laptops and workstations held only by designated people in the IT department
• Only software from an approved list used on company computers, patched and kept current
• New and modified software tested and validated in a sandbox before the live version changes
• Changes to IT systems planned and monitored through the IMS1 change control procedure

Who Needs a Software Policy Procedure?

Businesses that want control over what software staff install and use, including those that develop or modify their own software.

Using the Policy

Edit the admin rights arrangements, the approved software list and the development steps to match how your business works, and name the person in the Controlled By field. Give it top level approval and brief staff, particularly anyone who requests or installs software.

Related Documents

P-38 Software Installation Policy is a related policy on software installation, and GG-8-03 Software and Malware Guidance and TT-8-03 Software and Malware Training Talk help managers and staff put software controls into practice.

Admin Rights and Approved Software

Outside designated people in the IT department, no employee has admin rights to their laptop or workstation, a control that stops intentional or accidental installation of unlicensed or unsafe software. Only software from an approved list is used, it is patched and kept current, and security software is never removed or deactivated.

Sandbox Testing Before Release

New software and changes to existing software follow the same defined development process, with the required tests, validation and approval completed before release. All development and modification work is tested and validated in a sandbox environment before the live version is changed.