Assessment Objective

Determine if:

• CM-07(07) the execution of binary or machine-executable code is only allowed in confined physical or virtual machine environments;
  • CM-07(07)(a) the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of [Assignment: personnel or roles];
  • CM-07(07)(b) the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of [Assignment: personnel or roles].

Assessment Methods

Examine

• Configuration management policy
• procedures addressing least functionality in the system
• configuration management plan
• system design documentation
• system configuration settings and associated documentation
• list or record of binary or machine-executable code
• system component inventory
• common secure configuration checklists
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for approving execution of binary or machine-executable code
• organizational personnel with information security responsibilities
• organizational personnel with software management responsibilities
• system/network administrators
• system developers

Test

• Organizational process for approving execution of binary or machine-executable code
• organizational process for confining binary or machine-executable code to physical or virtual machine environments
• mechanisms supporting and/or implementing the confinement of binary or machine-executable code to physical or virtual machine environments

Tichete legate

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final