Assessment Objective
Determine if:
- SC-18a.
- SC-18a.[01] acceptable mobile code is defined;
- SC-18a.[02] unacceptable mobile code is defined;
- SC-18a.[03] acceptable mobile code technologies are defined;
- SC-18a.[04] unacceptable mobile code technologies are defined;
- SC-18b.
- SC-18b.[01] the use of mobile code is authorized within the system;
- SC-18b.[02] the use of mobile code is monitored within the system;
- SC-18b.[03] the use of mobile code is controlled within the system.
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing mobile code
- mobile code implementation policy and procedures
- list of acceptable mobile code and mobile code technologies
- list of unacceptable mobile code and mobile technologies
- authorization records
- system monitoring records
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- organizational personnel with responsibilities for managing mobile code
Test
- Organizational process for authorizing, monitoring, and controlling mobile code
- mechanisms supporting and/or implementing the management of mobile code
- mechanisms supporting and/or implementing the monitoring of mobile code
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SC-18 [M] Mobile Code |