Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sc-18(2)

mobile code  | acquisition / development / use

assessment objective:

Determine if the organization:

sc-18(2)[1]

defines requirements for:

sc-18(2)[1][a]

the acquisition of mobile code;

sc-18(2)[1][b]

the development of mobile code;

sc-18(2)[1][c]

the use of mobile code; and

sc-18(2)[2]

ensures that the acquisition, development, and use of mobile code to be deployed in the information system meets organization-defined mobile code requirements.

potential assessment methods and objects:

Examine: [select from: System and communications protection policy; procedures addressing mobile code; mobile code requirements; mobile code usage restrictions, mobile code implementation policy and procedures; acquisition documentation; acquisition contracts for information system, system component, or information system service; system development life cycle documentation; other relevant documents or records].

Interview: [select from: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for managing mobile code; organizational personnel with acquisition and contracting responsibilities].

Test: [select from: Organizational processes for the acquisition, development, and use of mobile code].