CCI-002736

The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only with the explicit approval of organization-defined personnel or roles.

Implementation Guidance

The organization being inspected/assessed allows execution of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code only with the explicit approval of the ISSO or ISSM. DoD has defined has personnel or roles as the ISSO or ISSM.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the software list and examines the information system to ensure the organization being inspected/assessed allows execution of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code only with the explicit approval of the ISSO or ISSM. DoD has defined has personnel or roles as the ISSO or ISSM.

Compelling Evidence

1.) ISSO or ISSM approval documentation.

The controls below (if any) were marked by NIST as being related to CCI-002736.