SC-27 Platform-independent Applications. Include within organizational systems the following platform independent applications: [organization-defined]
Platform-independent Applications. Include within organizational systems the following platform independent applications: [organization-defined].
5
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Design or build evidence showing the application does not depend on a specific platform · Document repository
- Evidence the application has been run on more than one platform, demonstrating the independence claimed · Document repository
- Maintenance evidence that platform independence is preserved through change · Document repository
governing documentDocuments that govern the control
- The defined platform independent applications included within the system · Document repository
- Rationale linking platform independence to the resilience or diversity objective it serves · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Independence claimed from the language runtime while the application depends on platform specific services
- Never actually deployed on a second platform, so portability is theoretical
- Platform specific dependencies introduced during maintenance with no check against the requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-26 Decoys. Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks · SC-28 Protection of information at rest