The organization should identify what types of software installations are permitted (e.g. updates and security patches to existing software) and what types of installations are
prohibited (e.g. software that is only for personal use and software whose pedigree with regard to being potentially malicious is unknown or suspect).