Assessment Objective
Determine if:
- CM-07(08)(a) the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code;
- CM-07(08)(b)
- CM-07(08)(b)[01] exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operational requirements;
- CM-07(08)(b)[02] exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing official.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing least functionality in the system
- configuration management plan
- system security plan
- system design documentation
- system configuration settings and associated documentation
- list or record of binary or machine-executable code
- system component inventory
- common secure configuration checklists
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for determining mission and operational requirements
- authorizing official for the system
- organizational personnel with information security responsibilities
- organizational personnel with software management responsibilities
- system/network administrators
Test
- Organizational process for approving execution of binary or machine-executable code
- mechanisms supporting and/or implementing the prohibition of binary or machine-executable code
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | CM-07(08) Binary or Machine Executable Code |