---

id: "SC-18(02)" title: "Acquisition, Development, and Use" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-18.02" priority: "P1" implementation_level: "organization" parent: "SC-18" enhancement: True

---

Statement

Verify that the acquisition, development, and use of mobile code to be deployed in the system meets {{ insert: param, sc-18.02_odp }}.

Guidance

None.

Assessment Objective: the acquisition of mobile code to be deployed in the system meets {{ insert: param, sc-18.02_odp }};

Assessment Objective: the development of mobile code to be deployed in the system meets {{ insert: param, sc-18.02_odp }};

Assessment Objective: the use of mobile code to be deployed in the system meets {{ insert: param, sc-18.02_odp }}.

System and communications protection policy

procedures addressing mobile code

mobile code requirements

mobile code usage restrictions

mobile code implementation policy and procedures

acquisition documentation

acquisition contracts for system, system component, or system service

system development life cycle documentation

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for managing mobile code

organizational personnel with acquisition and contracting responsibilities

Organizational processes for the acquisition, development, and use of mobile code