CMMC 1.0 Practice SC.3.188 Requirement:

Control and monitor the use of mobile code.

CMMC 1.0 SC.3.188 Requirement Explanation:

Malware is often delivered via mobile code, hence it's use must be controlled. Examples of mobile code include Java, JavaScript, ActiveX, Postscript, PDF, Shockwave, Flash animations, and VBScript.

Example CMMC 1.0 SC.3.188 Implementation:

Deploy DISA STIG settings for your browsers, Java applications (JRE) and PDF readers (Acrobat). The DISA STIG settings will improve your security and control mobile code. Make sure that you are blocking the execution of mobile code. You can set options that allow users to run mobile code on their systems. Document your settings in the DISA STIG viewer.

CMMC 1.0 SC.3.188 Scenario(s):

- Scenario 1:

Your policy requires that mobile code is blocked and allowed by exception. You trust your users to use their judgement when allowing mobile code. Your company deployed DISA STIG settings to secure it's browsers. The settings include controls restricting the execution of mobile code such as ActiveX and JavaScript. When a user visits a site that wants to execute ActiveX it is blocked unless the user allows it. This is in accordance with your documented mobile code policy.

Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:


Compliance Accelerator

Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.

Quantum Assessor

Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.

Supply Chain Verifier

Trust is everything. Verify, monitor, and support subcontactor compliance.