CMMC Practice MA.L2-3.7.4

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

Bold Coast Security Guidance

There must be a practice in place to scan diagnostic and testing software prior to use, and a formal written policy must require the practice. Diagnostic and security or performance testing software should be stored securely, and require some authorization to use. Dual control is a concept that can be applied. It means that no one person has the authority or ability to unilaterally check-out diagnostic and/or security software for use. At least two people must be involved in the process of using these applications, and sign-off on their use.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

DRAFT NIST SP 800-171 R2 If, upon inspection of media containing maintenance diagnostic and test programs, organizations determine that the media contain malicious code, the incident is handled consistent with incident handling policies and procedures.