CCI-002461

The organization allows execution of permitted mobile code only in confined virtual machine environments.

Implementation Guidance

The organization being inspected/assessed documents within the system and communications protection policy and implements mechanisms to allow the execution of permitted mobile code only in confined virtual machine environments. Unacceptable mobile code is defined in SC-18 (3).

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the system and communications protection policy and inspects the information systems to ensure the organization being inspected/assessed implements mechanisms to allow the execution of permitted mobile code only in confined virtual machine environments.

Compelling Evidence

1.) Signed and dated communications protection policy.

The controls below (if any) were marked by NIST as being related to CCI-002461.