"Procedures and measures shall be implemented to securely manage software installation on operational systems."[1]

Software installations must be approved by the IT group. Allowing users to install software without restrictions on their system's increases cyber risk. User's may accidentally install malware on their systems. Additionally the more software in the information system the larger the attack surface. Unmanaged software is also difficult to keep updated which can result increased vulnerabilities.