SC-18(2)

Requirement

Verify that the acquisition, development, and use of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements].

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing mobile code; mobile code requirements; mobile code usage restrictions; mobile code implementation policy and procedures; acquisition documentation; acquisition contracts for system, system component, or system service; system development life cycle documentation; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for managing mobile code; organizational personnel with acquisition and contracting responsibilities].

Test

[SELECT FROM: Organizational processes for the acquisition, development, and use of mobile code].

ID	Assessment Objectives
SC-18(02)[01]	the acquisition of mobile code to be deployed in the system meets <SC-18(02)_ODP mobile code requirements>;
SC-18(02)[02]	the development of mobile code to be deployed in the system meets <SC-18(02)_ODP mobile code requirements>;
SC-18(02)[03]	the use of mobile code to be deployed in the system meets <SC-18(02)_ODP mobile code requirements>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!