SC-18(5)

Requirement

Allow execution of permitted mobile code only in confined virtual machine environments.

Discussion

Permitting the execution of mobile code only in confined virtual machine environments helps prevent the introduction of malicious code into other systems and system components.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing mobile code; mobile code usage allowances; mobile code usage restrictions; system design documentation; system configuration settings and associated documentation; list of confined virtual machine environments in which the execution of organizationally acceptable mobile code is allowed; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developer; organizational personnel with responsibilities for managing mobile code].

Test

[SELECT FROM: Mechanisms allowing for the execution of permitted mobile code in confined virtual machine environments].

ID	Assessment Objectives
SC-18(05)	execution of permitted mobile code is allowed only in confined virtual machine environments.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!