SC-18 Mobile Code. Define acceptable and unacceptable mobile code and mobile code technologies; and Authorize, monitor, and control the use of mobile code within the system
Mobile Code. Define acceptable and unacceptable mobile code and mobile code technologies; and Authorize, monitor, and control the use of mobile code within the system.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring evidence showing mobile code use is observed and unauthorised use detected · Endpoint management (MDM / EDR)
periodic reviewEvidence produced at each review
- Authorisation records for the use of mobile code within the system · Endpoint management (MDM / EDR)
- Review record showing the acceptability lists were revisited as technologies changed · Document repository
governing documentDocuments that govern the control
- The defined lists of acceptable and unacceptable mobile code and mobile code technologies · Policy repository / GRC workspace
- Configuration enforcing the restriction, such as browser, endpoint or gateway policy blocking unacceptable technologies · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Endpoint management (MDM / EDR) on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Lists written years ago naming technologies no longer in use while current script and macro technologies are unaddressed
- Policy defined with no enforcement point, so the lists describe an intent rather than a control
- No monitoring, so unauthorised mobile code use is invisible
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-17 Public key infrastructure certificates · SC-20 Secure name/address resolution service