The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.
No STIG checks reference this CCI.