id: "SC-42" title: "Sensor Capability and Data" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-42" priority: "P1" implementation_level: "system" enhancements: - sc-42.1 - sc-42.2 - sc-42.3 - sc-42.4 - sc-42.5
Prohibit {{ insert: param, sc-42_odp.01 }} ; and
Provide an explicit indication of sensor use to {{ insert: param, sc-42_odp.05 }}.
Guidance
Sensor capability and data applies to types of systems or system components characterized as mobile devices, such as cellular telephones, smart phones, and tablets. Mobile devices often include sensors that can collect and record data regarding the environment where the system is in use. Sensors that are embedded within mobile devices include microphones, cameras, Global Positioning System (GPS) mechanisms, and accelerometers. While the sensors on mobiles devices provide an important function, if activated covertly, such devices can potentially provide a means for adversaries to learn valuable information about individuals and organizations. For example, remotely activating the GPS function on a mobile device could provide an adversary with the ability to track the movements of an individual. Organizations may prohibit individuals from bringing cellular telephones or digital cameras into certain designated facilities or controlled areas within facilities where classified information is stored or sensitive conversations are taking place.
Assessment Objective: {{ insert: param, sc-42_odp.01 }} is/are prohibited;
Assessment Objective: an explicit indication of sensor use is provided to {{ insert: param, sc-42_odp.05 }}.
System and communications protection policy
procedures addressing sensor capabilities and data collection
access control policy and procedures
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
privacy plan
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
system developer
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for sensor capabilities
Mechanisms implementing access controls for the remote activation of system sensor capabilities
mechanisms implementing the capability to indicate sensor use