CMMC Practice Requirement:

Control and monitor the use of mobile code.

CMMC Requirement Explanation:

Malware is often delivered via mobile code, hence it's use must be controlled. Examples of mobile code include Java, JavaScript, ActiveX, Postscript, PDF, Shockwave, Flash animations, and VBScript.

Example CMMC Implementation:

Deploy DISA STIG settings for your browsers, Java applications (JRE) and PDF readers (Acrobat). The DISA STIG settings will improve your security and control mobile code. Make sure that you are blocking the execution of mobile code. You can set options that allow users to run mobile code on their systems. Document your settings in the DISA STIG viewer.


- Scenario 1:

Your policy requires that mobile code is blocked and allowed by exception. You trust your users to use their judgement when allowing mobile code. Your company deployed DISA STIG settings to secure it's browsers. The settings include controls restricting the execution of mobile code such as ActiveX and JavaScript. When a user visits a site that wants to execute ActiveX it is blocked unless the user allows it. This is in accordance with your documented mobile code policy.

Discover Our NIST SP 800-171 Solutions:


Compliance Accelerator

For contractors seeking compliance

Quantum Assessor

For IT service providers

Supply Chain Verifier

For contractors seeking to verify partner compliance