One issue we keep coming up against when trying to implement 800-171 is finding terms that aren't well defined and how to interpret them or find a federally accepted definition.

For example, the controls make a lot of references to 'software' and 'install' (like 3.4.9). In this case, the NIST definition of 'installation' is somewhat helpful , but 'software' has a dozen definitions, none of them super helpful.

Is uncompiled code software? Does compiling it count as an installation? What about cloning a repo? Is a script software? Is a linux user that writes a simple shell script in their home directory installing software? Would a series of Powershell commands in a text file be software? Would changing the extension to .ps1 count as installing?

My gut says to just take the most restrictive approach and say yes to all of the above, but I worry that always erring on the side of caution is going to result in an environment that's extremely difficult to build and maintain, and functionally useless.

Anyone have any good resources or suggestions for clarifying some of these things? We have worked with an outside consultant and it was extremely helpful but it feels like we have to learn to sort some of this out on our own for this to be successful long-term.