CCI-002458

Implementation Guidance

The organization being inspected/assessed defines and documents unacceptable mobile code IAW the Protection Profile for Web Browsers and Application SRG. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must define IAW the STIG/SRG guidance that pertains to CCI 2458. DoD has determined the unacceptable mobile code is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented acceptable and unacceptable mobile code and mobile code technologies to ensure the organization being inspected/assessed defines unacceptable mobile code IAW the Protection Profile for Web Browsers and Application SRG. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has defined unacceptable mobile code IAW the applicable STIGs and SRGs pertaining to CCI 2458. DoD has determined the unacceptable mobile code is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated document that defines what constitutes unacceptable mobile code for its information systems. 2.) Applicable STIG/SRG checks pertaining to CCI 2458.