Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- END-13_A01 acceptable mobile code technologies are defined.
Assessment rigor: 1
Origin: 53A_R5_SC-18a.[01] 53A_R5_SC-18a.[03] 171A_R3_A.03.13.13.a[02] - END-13_A02 unacceptable mobile code technologies are defined.
Assessment rigor: 1
Origin: 53A_R5_SC-18a.[02] 53A_R5_SC-18a.[04] 53A_R5_SC-18(01)[01] 53A_R5_SC-18(01)_ODP[01] - END-13_A03 the use of mobile code is authorized, monitored and controlled.
Assessment rigor: 1
Origin: 53A_R5_SC-18b.[01] 53A_R5_SC-18b.[02] 53A_R5_SC-18b.[03] 171A_3.13.13[a] 171A_3.13.13[b] - END-13_A04 the download of unacceptable mobile code is prevented.
Assessment rigor: 1
Origin: 53A_R5_SC-18(03)[01] - END-13_A05 the execution of unacceptable mobile code is prevented.
Assessment rigor: 1
Origin: 53A_R5_SC-18(03)[02] - END-13_A06 corrective actions to be taken when unacceptable mobile code is identified are defined.
Assessment rigor: 1
Origin: 53A_R5_SC-18(01)_ODP[02] - END-13_A07 corrective actions are taken if unacceptable mobile code is identified.
Assessment rigor: 1
Origin: 53A_R5_SC-18(01)[02] - END-13_A08 mobile code requirements for the acquisition, development and use of mobile code to be deployed in the system are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-18(02)_ODP - END-13_A09 the acquisition of mobile code to be deployed in the system meets mobile code requirements.
Assessment rigor: 3
Origin: 53A_R5_SC-18(02)[01] - END-13_A10 the development of mobile code to be deployed in the system meets mobile code requirements.
Assessment rigor: 3
Origin: 53A_R5_SC-18(02)[02] - END-13_A11 the use of mobile code to be deployed in the system meets mobile code requirements.
Assessment rigor: 3
Origin: 53A_R5_SC-18(02)[03] - END-13_A12 unacceptable mobile code to be prevented from downloading and executing is defined.
Assessment rigor: 3
Origin: 53A_R5_SC-18(03)_ODP - END-13_A13 software applications in which the automatic execution of mobile code is to be prevented are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-18(04)_ODP[01] - END-13_A14 actions to be enforced by the system prior to executing mobile code are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-18(04)_ODP[02] - END-13_A15 the automatic execution of mobile code in software applications is prevented.
Assessment rigor: 3
Origin: 53A_R5_SC-18(04)[01] 53A_R5_SC-18(04)[02] - END-13_A16 platform-independent applications to be included within organizational systems are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-27_ODP - END-13_A17 platform-independent applications are included within organizational systems.
Assessment rigor: 3
Origin: 53A_R5_SC-27 - END-13_A18 acceptable mobile code is defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.13.a[01] - END-13_A19 the use of mobile code is authorized.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.13.b[01] - END-13_A20 the use of mobile code is monitored.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.13.b[02] - END-13_A21 the use of mobile code is controlled.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.13.b[03]
Lingitud teemad
| Lingi tüüp | Teema |
|---|---|
| blocks | Mobile Code |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.