What an auditor, or Sekit's evidence engine, asks for.
Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
Change and release management records
The process to review and approve changes to production systems before applying them, and how new versions are released in a controlled way.
From the Sekit evidence catalog
In practice
The real risk here is not a rogue install, it is drift nobody tracks: a developer adds a package to a production server to fix something quickly and it never gets documented or removed. What works: keep a live software inventory with an owner per entry, run discovery tooling that flags anything unexpected or unlicensed on production systems, and push changes through a deployment pipeline that can roll back rather than manual installs on live servers. Auditors ask to see the software inventory next to what discovery tooling found running, and whether the two match.
Common gaps
The software inventory is updated manually and several applications discovered by the endpoint tool do not appear on the documented list at all.
Production changes are sometimes applied directly on the server outside the deployment pipeline when someone is in a hurry, bypassing the rollback safety net.
Nobody owns the removal of unused SaaS subscriptions, so tools people stopped using months ago remain installed and licensed.
Questions your auditor will ask
How do you know what software is installed on production systems, versus what should be?
Automated discovery tooling scans endpoints and reports installed software, flagging anything unexpected or outside the approved set against the software and SaaS inventory.
Can someone install new software directly on a live production system?
Changes go through the release pipeline, which produces a repeatable, logged deployment and supports rolling back quickly if a release causes a problem.
Is the software inventory kept current, including licence status?
Yes, the inventory tracks each application's licence and owner, and entries are removed or licences cancelled once a tool is no longer needed.
Where regulation demands it
NIS2 art. 6.4 covers change management for production systems, including how new software reaches them. ENS op.exp.1 requires an asset inventory that includes installed software.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.