Why it matters
Uncontrolled software installation is a common way malware or unlicensed risk enters production systems.
How a self-led small team implements it
Restrict install permissions on production systems to a small named group; MDM policy on endpoints covers the rest.
What auditors expect to see
Install permission restrictions, MDM policy.
Track A.8.19 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS