---

id: "SC-18(04)" title: "Prevent Automatic Execution" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-18.04" priority: "P1" implementation_level: "system" parent: "SC-18" enhancement: True

---

Statement

Prevent the automatic execution of mobile code in {{ insert: param, sc-18.04_odp.01 }} and enforce {{ insert: param, sc-18.04_odp.02 }} prior to executing the code.

Guidance

Actions enforced before executing mobile code include prompting users prior to opening email attachments or clicking on web links. Preventing the automatic execution of mobile code includes disabling auto-execute features on system components that employ portable storage devices, such as compact discs, digital versatile discs, and universal serial bus devices.

Assessment Objective: the automatic execution of mobile code in {{ insert: param, sc-18.04_odp.01 }} is prevented;

Assessment Objective: {{ insert: param, sc-18.04_odp.02 }} are enforced prior to executing mobile code.

System and communications protection policy

procedures addressing mobile code

mobile code usage restrictions

mobile code implementation policy and procedures

system design documentation

system configuration settings and associated documentation

list of software applications in which the automatic execution of mobile code must be prohibited

list of actions required before execution of mobile code

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with responsibilities for managing mobile code

Mechanisms preventing the automatic execution of unacceptable mobile code

mechanisms enforcing actions to be taken prior to the execution of the mobile code