Assessment Objective

Determine if:

• CM-07(02) program execution is prevented in accordance with [Selection (one or more): [Assignment: policies, rules of behavior, and/or access agreements regarding software program usage and restrictions] ; rules authorizing the terms and conditions of software program usage].

Assessment Methods

Examine

• Configuration management policy
• procedures addressing least functionality in the system
• configuration management plan
• system design documentation
• system configuration settings and associated documentation
• system component inventory
• common secure configuration checklists
• specifications for preventing software program execution
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information security responsibilities
• system/network administrators
• system developers

Test

• Organizational processes preventing program execution on the system
• organizational processes for software program usage and restrictions
• mechanisms preventing program execution on the system
• mechanisms supporting and/or implementing software program usage and restrictions

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final