SC-34 Non-modifiable Executable Programs. For [organization-defined] , load and execute: The operating environment from hardware-enforced, read-only media; and The following applications from hardware-enforced, read-only media: [organization-defined]
Non-modifiable Executable Programs. For [organization-defined] , load and execute: The operating environment from hardware-enforced, read-only media; and The following applications from hardware-enforced, read-only media.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Boot or load records showing the operating environment executed from that media · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Evidence the media enforcement is hardware based, such as a physical write protect or read only device, not a software attribute · Physical access / facilities
governing documentDocuments that govern the control
- Definition of the systems in scope and the operating system components and applications required to load from read-only media · Policy repository / GRC workspace
- Procedure for updating the read-only media, including who authorises and how integrity is re-established · Policy repository / GRC workspace
- Verification that the executing image matches the authorised image · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Read only enforced by file system permissions rather than hardware, which the control specifically excludes
- Operating environment loaded from protected media while applications load from writable storage
- Update procedure undefined, so the write protect is left disabled after maintenance
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-32 System Partitioning. Partition the system into [organization-defined] residing in separate [organization-defined] domains or environments based on [organization-defined] · SC-35 External Malicious Code Identification. Include system components that proactively seek to identify network-based malicious code or malicious websites