Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- CFG-14.1_A01 a policy and/or process specifying whether whitelisting or blacklisting is to be implemented is specified.
Defined parameters: allowlisting, implemented as a deny-all, permit-by-exception policy
Assessment rigor: 2
Origin: 171A_3.4.8[a] - CFG-14.1_A02 the software allowed to execute under whitelisting or denied use under blacklisting is specified.
Assessment rigor: 1
Origin: 171A_3.4.8[b] - CFG-14.1_A03 whitelisting to allow the execution of authorized software or blacklisting to prevent the use of unauthorized software is implemented as specified.
Assessment rigor: 1
Origin: 171A_3.4.8[c] - CFG-14.1_A04 registration requirements for functions, ports, protocols and services are defined.
Assessment rigor: 2
Origin: 53A_R5_CM-07(03)_ODP - CFG-14.1_A05 an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system.
Assessment rigor: 2
Origin: 53A_R5_CM-07(04)(b) - CFG-14.1_A06 the list of unauthorized software programs is reviewed / updated organization-defined frequency.
Defined parameters: at least quarterly or when there is a change
Assessment rigor: 2
Origin: 53A_R5_CM-07(04)(c) - CFG-14.1_A07 organization-defined registration requirements are complied with.
Assessment rigor: 3
Origin: 53A_R5_CM-07(03) - CFG-14.1_A08 software programs not authorized to execute on the system are defined.
Assessment rigor: 3
Origin: 53A_R5_CM-07(04)_ODP[01] - CFG-14.1_A09 frequency at which to review / update the list of unauthorized software programs is defined.
Defined parameters: at least quarterly or when there is a change
Assessment rigor: 3
Origin: 53A_R5_CM-07(04)_ODP[02] - CFG-14.1_A10 organization-defined software programs are identified.
Assessment rigor: 3
Origin: 53A_R5_CM-07(04)(a) 53A_R5_CM-07(05)(a) - CFG-14.1_A11 software programs authorized to execute on the system are identified.
Assessment rigor: 2
Origin: 53A_R5_CM-07(05)_ODP[01] 171A_R3_A.03.04.08.a - CFG-14.1_A12 the frequency at which to review and update the list of authorized software programs is defined.
Defined parameters: at least quarterly or when there is a change
Assessment rigor: 2
Origin: 53A_R5_CM-07(05)_ODP[02] 171A_R3_A.03.04.08.ODP[01] - CFG-14.1_A13 a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.
Assessment rigor: 2
Origin: 53A_R5_CM-07(05)(b) 171A_R3_A.03.04.08.b - CFG-14.1_A14 the list of authorized software programs is reviewed / updated organization-defined frequency.
Defined parameters: at least quarterly or when there is a change
Assessment rigor: 3
Origin: 53A_R5_CM-07(05)(c) - CFG-14.1_A15 the automatic execution of mobile code in organization-defined software applications is prevented.
Assessment rigor: 3
Origin: 53A_R5_SC-18(04)[01] - CFG-14.1_A16 organization-defined actions are enforced prior to executing mobile code.
Assessment rigor: 3
Origin: 53A_R5_SC-18(04)[02] - CFG-14.1_A17 the use of mobile code is controlled.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.13.b[03]
Povezani zadaci
| Vrsta poveznice | Zadatak |
|---|---|
| blocks | Explicitly Allow / Deny Applications |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.