CPCSC Level 2 Control

Last updated June 25, 2026

03.04.08Configuration management

CPCSC Level 2 03.04.08: Authorized Software - Allow by Exception

Apply authorized software - allow by exception to keep systems configured, changed, inventoried, and hardened in a controlled way for CPCSC Level 2 readiness. This guide separates the official ITSP.10.171 control language from practical implementation, evidence, auditor questions, and related controls.

Open Level 2 Guide Browse Level 2 Controls

Formal Control Language

Official ITSP.10.171 wording for 03.04.08. Use the Cyber Centre publication and contract requirements as the source of truth for certification, assessment, or procurement submissions.

  • Identify software programs authorized to execute on the system
  • Implement a deny-all, allow-by-exception policy for the execution of software programs on the system
  • Review and update the list of authorized software programs [Assignment: organization-defined frequency]

Contains information sourced from Government of Canada material used under the Open Government Licence - Canada.

What This Means In Plain English

Authorized Software - Allow by Exception is part of the CPCSC Level 2 Configuration management family. This is about knowing what a secure configuration looks like and controlling how systems move away from that baseline.

For a founder, CISO, engineer, or compliance owner, the practical question is whether authorized software - allow by exception is visible in real operating evidence: a setting, workflow, ticket, log, approval, review, or exception record that can survive an external assessment.

Level 2 is different from Level 1 because the evidence has to survive an external assessment. A policy statement helps, but the stronger answer is a record that shows who did the work, when it ran, what system setting or workflow enforced it, and how exceptions were handled.

How To Implement It

1

Define the in-scope systems, owners, users, vendors, and data flows affected by authorized software - allow by exception.

2

Create baselines for in-scope systems, track inventory, review changes, restrict configuration access, and remove unnecessary software and services.

3

Translate the formal requirement into one or two operating procedures: who performs it, how often, where it is recorded, and who approves exceptions.

4

Configure the relevant systems so the control is enforced by identity, endpoint, cloud, network, ticketing, monitoring, vendor, or documentation workflows rather than memory.

5

Keep evidence in a consistent folder, GRC system, ticket queue, or audit workspace so an assessor can trace the control from requirement to implementation to review.

Evidence Normally Gathered

Authorized Software - Allow by Exception: baseline configuration documents.

Authorized Software - Allow by Exception: change tickets.

Authorized Software - Allow by Exception: asset inventory.

Authorized Software - Allow by Exception: configuration screenshots.

Authorized Software - Allow by Exception: software allowlist or inventory.

Authorized Software - Allow by Exception: exception records.

Authorized Software - Allow by Exception: owner assignment and review cadence.

Authorized Software - Allow by Exception: exception, remediation, or POA&M records when the control is not fully implemented.

Common Auditor Questions

Where is authorized software - allow by exception implemented in the in-scope environment?

Who owns authorized software - allow by exception, and how do they know it is operating?

Show the evidence that proves authorized software - allow by exception ran during the assessment period.

What happens when authorized software - allow by exception fails, is bypassed, or has an exception?

How does this control connect to the system security plan, risk register, POA&M, and related CPCSC controls?

Sources

Source and attribution.

Formal control language is sourced from the Canadian Centre for Cyber Security ITSP.10.171 publication. CPCSC Level 2 assessment context references the Government of Canada CPCSC program overview and ITSP.10.171-01 assessment guidance.

CPCSC Program OverviewITSP.10.171ITSP.10.171-01Open Government Licence - Canada