---

id: "SC-18(01)" title: "Identify Unacceptable Code and Take Corrective Actions" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-18.01" priority: "P1" implementation_level: "system" parent: "SC-18" enhancement: True

---

Statement

Identify {{ insert: param, sc-18.01_odp.01 }} and take {{ insert: param, sc-18.01_odp.02 }}.

Guidance

Corrective actions when unacceptable mobile code is detected include blocking, quarantine, or alerting administrators. Blocking includes preventing the transmission of word processing files with embedded macros when such macros have been determined to be unacceptable mobile code.

Assessment Objective: {{ insert: param, sc-18.01_odp.01 }} is identified;

Assessment Objective: {{ insert: param, sc-18.01_odp.02 }} are taken if unacceptable mobile code is identified.

System and communications protection policy

procedures addressing mobile code

mobile code usage restrictions

mobile code implementation policy and procedures

system design documentation

system configuration settings and associated documentation

list of unacceptable mobile code

list of corrective actions to be taken when unacceptable mobile code is identified

system monitoring records

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing mobile code

Mechanisms supporting and/or implementing mobile code detection, inspection, and corrective capabilities