CCI-001161

The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.

Implementation Guidance

The organization being inspected/assessed documents usage restrictions for acceptable mobile code and mobile code technologies IAW the Protection Profile for Web Browsers and Application SRG. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must establish IAW the STIG/SRG guidance that pertains to CCI 1161.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented usage restrictions to ensure the organization being inspected/assessed establishes usage restrictions for acceptable mobile code and mobile code technologies IAW the Protection Profile for Web Browsers and Application SRG. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has established usage restrictions IAW the applicable STIGs and SRGs pertaining to CCI 1161.

Compelling Evidence

1.) Signed and dated system and communications protection policy (reference mobile code section). 2.) Applicable STIG/SRG checks pertaining to CCI 1161.

The controls below (if any) were marked by NIST as being related to CCI-001161.