Mobile Code

Official Source Material

Control and monitor the use of mobile code.

Determine if:

[a] use of mobile code is controlled; and
[b] use of mobile code is monitored.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Mobile code is code that arrives over the network and runs without installation.

JavaScript in every web page, active content in PDF files, browser plug-ins, and script attachments are the subject: the assessment guide names Java, JavaScript, ActiveX, Postscript, PDF, Flash, and VBScript. It has nothing to do with applications on mobile phones, and a policy about installing unauthorized software misses it entirely.

Allowing is controlling, when the decision is written down.

Control under [a] means deliberate, documented decisions about which mobile code runs. Permitting JavaScript in managed browsers while prohibiting legacy plug-ins and unsigned macros is control. Enforce the decisions through browser management and the Office macro settings in your configuration baseline, with an exception path for the business need that arrives later.

Monitoring rides your existing malware protection.

Objective [b] is satisfied by the tooling you run under SI.L2-3.14.2. State which mobile code technologies your endpoint protection and web filtering inspect, and keep the alerts and their review as the record. A blocked script in the detection history is monitoring evidence.

What falls short

A policy that users may not download or install unauthorized software. Mobile code executes without installation, so the policy does not control it and shows nothing for [a] or [b].

Edge cases

Developers who write and run scripts are using mobile code technologies legitimately. Authorize the languages for the named role, prohibit the rest, and let the anti-malware monitoring cover what executes.