Assessment Objective

Determine if:

• SC-18a.
  • SC-18a.[01] acceptable mobile code is defined;
  • SC-18a.[02] unacceptable mobile code is defined;
  • SC-18a.[03] acceptable mobile code technologies are defined;
  • SC-18a.[04] unacceptable mobile code technologies are defined;
• SC-18b.
  • SC-18b.[01] the use of mobile code is authorized within the system;
  • SC-18b.[02] the use of mobile code is monitored within the system;
  • SC-18b.[03] the use of mobile code is controlled within the system.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing mobile code
• mobile code implementation policy and procedures
• list of acceptable mobile code and mobile code technologies
• list of unacceptable mobile code and mobile technologies
• authorization records
• system monitoring records
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• organizational personnel with responsibilities for managing mobile code

Test

• Organizational process for authorizing, monitoring, and controlling mobile code
• mechanisms supporting and/or implementing the management of mobile code
• mechanisms supporting and/or implementing the monitoring of mobile code

Kwistjonijiet marbuta

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final