Navigate

SC-18 (4)

SC-18 (4): Prevent Automatic Execution

The information system prevents the automatic execution of mobile code in [Assignment: organization-defined software applications] and enforces [Assignment: organization-defined actions] prior to executing the code.

Supplemental

Actions enforced before executing mobile code, include, for example, prompting users prior to opening electronic mail attachments. Preventing automatic execution of mobile code includes, for example, disabling auto execute features on information system components employing portable storage devices such as Compact Disks (CDs), Digital Video Disks (DVDs), and Universal Serial Bus (USB) devices.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-18 (4).

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of SC-18 (4).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-18 (4).

CCI	Definition
CCI-001170	The information system prevents the automatic execution of mobile code in organization-defined software applications.
CCI-001171	The organization defines software applications in which automatic mobile code execution is to be prohibited.
CCI-001172	The organization defines actions to be enforced by the information system before executing mobile code.
CCI-002460	The information system enforces organization-defined actions prior to executing mobile code.