Navigate

CCI-001160

CCI-001160 Definition

The organization defines acceptable and unacceptable mobile code and mobile code technologies.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents acceptable and unacceptable mobile code and mobile code technologies IAW the Protection Profile for Web Browsers and Application SRG. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must define IAW the STIG/SRG guidance that pertains to CCI 1160.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented acceptable and unacceptable mobile code and mobile code technologies to ensure the organization being inspected/assessed defines acceptable and unacceptable mobile code and mobile code technologies IAW the Protection Profile for Web Browsers and Application SRG. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has defined acceptable and unacceptable mobile code and mobile code technologies IAW the applicable STIGs and SRGs pertaining to CCI 1160.

Compelling Evidence

1.) Signed an dated system and communications protection policy (reference mobile code section). 2.) Applicable STIG/SRG checks pertaining to CCI 1160.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001160.

Control	Description
SC-18	The organization: SC-18a.: Defines acceptable and unacceptable mobile code and mobile code technologies; SC-18b.: Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and SC-18c.: Authorizes, monitors, and controls the use of mobile code within the information system.