CM-7(7)

Requirement
Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] when such code is:
1. Obtained from sources with limited or no warranty; and/or
2. Without the provision of source code.

Discussion

Code execution in protected environments applies to all sources of binary or machine-executable code, including commercial software and firmware and open-source software.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing least functionality in the system; configuration management plan; system design documentation; system configuration settings and associated documentation; list or record of binary or machine-executable code; system component inventory; common secure configuration checklists; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for approving execution of binary or machine-executable code; organizational personnel with information security responsibilities; organizational personnel with software management responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Organizational process for approving execution of binary or machine-executable code; organizational process for confining binary or machine-executable code to physical or virtual machine environments; mechanisms supporting and/or implementing the confinement of binary or machine-executable code to physical or virtual machine environments].

ID	Assessment Objectives
CM-07(07)	the execution of binary or machine-executable code is only allowed in confined physical or virtual machine environments;
CM-07(07)(a)	the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of <CM-07(07)_ODP personnel or roles>;
CM-07(07)(b)	the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of <CM-07(07)_ODP personnel or roles>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!