Assessment Objective

Determine if:

• SC-34a. the operating environment for [Assignment: system components] is loaded and executed from hardware-enforced, read-only media;
• SC-34b. [Assignment: applications] for [Assignment: system components] are loaded and executed from hardware-enforced, read-only media.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing non-modifiable executable programs
• system design documentation
• system configuration settings and associated documentation
• system architecture
• list of operating system components to be loaded from hardware-enforced, read-only media
• list of applications to be loaded from hardware-enforced, read-only media
• media used to load and execute the system operating environment
• media used to load and execute system applications
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developer
• organizational personnel installing, configuring, and/or maintaining the system
• system developers/integrators

Test

• Mechanisms supporting and/or implementing, loading, and executing the operating environment from hardware-enforced, read-only media
• mechanisms supporting and/or implementing, loading, and executing applications from hardware-enforced, read-only media

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final