Skip to content
ControlVerdict
Sign in
SC.L2-3.13.13CMMC Level 2Level 2

Mobile Code

Submit your own example

Practice statement

Control and monitor the use of mobile code.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.13.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    use of mobile code is controlled; and

    1 example covers this

  2. [b]

    use of mobile code is monitored.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SC.L2-3.13.13Mobile Code
    Control and monitor the use of mobile code.

    • [a]

      use of mobile code is controlled; and

    • [b]

      use of mobile code is monitored.

    Macro and script allow-listing, with execution telemetry landing in the SIEM

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Mobile Code objectives: use of mobile code is controlled, and use of mobile code is monitored.

    What counts as mobile code here. Office macros and add-ins, browser JavaScript and extensions, PDF embedded scripting, PowerShell and Windows Script Host, HTML applications, and Java where it still exists. The organization writes this list down so the control has a testable scope instead of a category name.

    Control [a]. Macros in files from the internet or from email are blocked outright, not merely warned about. Macros that the business genuinely needs — three contracts workbooks and one estimating tool — are signed with an internal code-signing certificate and trusted by publisher, so the allow-list is cryptographic rather than a trusted-location folder anyone can write to. Attack surface reduction rules block Office child-process creation, executable content from email, and obfuscated script execution. Windows Script Host is disabled fleet-wide; PowerShell runs in constrained language mode for standard users while engineers' elevated accounts get full language on their own devices. Java browser plugins are removed, PDF JavaScript is disabled in the reader configuration, and browser extensions come from an allow-list with everything else blocked from installing.

    Monitoring [b]. PowerShell script block logging and module logging are on, and EDR script-execution and Office child-process telemetry forwards to the SIEM. ASR rules ran in audit mode for a release cycle before enforcement, which is how the four legitimate macros were discovered rather than by breaking someone's month-end close. Standing detections: unsigned macro execution attempt, encoded PowerShell command line, script interpreter spawned by an Office process, and new browser extension installation.

    User path when something is blocked. A blocked macro produces a help desk article link, not a dead end. The request route is: submit the file, security reviews the code, and if approved it is signed and published. This is what keeps people from asking to disable the policy.

    Maintenance. Monthly review of ASR audit-mode events for rules not yet enforced, and of block events for false positives. Quarterly review of the signed-macro list against actual business use; unused macros lose their signature. Annual review of the code-signing certificate's issuance controls.

    Accepted gap. One supplier portal requires a legacy browser plugin. It is reached only from a dedicated non-CUI virtual desktop with no access to the labeled store, and the exception carries an annual review with a vendor-migration ask on file.

    What the evidence looks like

    • Written definition of in-scope mobile code types
    • Group policy / MDM export for macro blocking, ASR rules, and PowerShell constrained language mode
    • Signed-macro inventory with the review record for each approved macro
    • SIEM detections and a sample investigation for a blocked script execution
    • Legacy plugin exception with its isolated virtual desktop configuration

    Environment

    Windows fleet. Contracts staff rely heavily on Excel macros; engineers run local Python and PowerShell for data reduction.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.