CCI-001688

Verify the acquisition of mobile code deployed in the system meets organization-defined mobile code requirements.

Implementation Guidance

Determine if: - the acquisition of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the development of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the use of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined].

Validation Procedures

Examine: [SELECT FROM: System and communications protection policy; procedures addressing mobile code; mobile code requirements; mobile code usage restrictions; mobile code implementation policy and procedures; acquisition documentation; acquisition contracts for system, system component, or system service; system development life cycle documentation; system security plan; other relevant documents or records]. Interview: [SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for managing mobile code; organizational personnel with acquisition and contracting responsibilities]. Test: [SELECT FROM: Organizational processes for the acquisition, development, and use of mobile code].

The controls below (if any) were marked by NIST as being related to CCI-001688.