The organization maintains the list of software programs not authorized to execute on the information system.
No STIG checks reference this CCI.