Assessment Objective
Determine if:
- SC-18(02)[01] the acquisition of mobile code to be deployed in the system meets [Assignment: mobile code requirements];
- SC-18(02)[02] the development of mobile code to be deployed in the system meets [Assignment: mobile code requirements];
- SC-18(02)[03] the use of mobile code to be deployed in the system meets [Assignment: mobile code requirements].
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing mobile code
- mobile code requirements
- mobile code usage restrictions
- mobile code implementation policy and procedures
- acquisition documentation
- acquisition contracts for system, system component, or system service
- system development life cycle documentation
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- organizational personnel with responsibilities for managing mobile code
- organizational personnel with acquisition and contracting responsibilities
Test
- Organizational processes for the acquisition, development, and use of mobile code
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | SC-18(02) Acquisition, Development, and Use |