The organization defines the personnel or roles to be notified when unauthorized software is detected.
No STIG checks reference this CCI.