CCI-002481

Employ virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency.

Implementation Guidance

Determine if virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [SC-29(01)_ODP; the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined].

Validation Procedures

Examine: [SELECT FROM: System and communications protection policy; configuration management policy and procedures; system design documentation; system configuration settings and associated documentation; system architecture; list of operating systems and applications deployed using virtualization techniques; change control records; configuration management records; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for implementing approved virtualization techniques to the system]. Test: [SELECT FROM: Mechanisms supporting and/or implementing the employment of a diverse set of information technologies; mechanisms supporting and/or implementing virtualization techniques].

The controls below (if any) were marked by NIST as being related to CCI-002481.