SC-34: Non-Modifiable Executable Programs
Generated
2019-05-20 15:48:11.984914
Status
Statements
The information system at [Assignment: organization-defined information system components]:
| Code | Description |
|---|---|
| SC-34a. | Loads and executes the operating environment from hardware-enforced, read-only media; and |
| SC-34b. | Loads and executes [Assignment: organization-defined applications] from hardware-enforced, read-only media. |
Additional Guidance
The term operating environment is defined as the specific code that hosts applications, for example, operating systems, executives, or monitors including virtual machine monitors (i.e., hypervisors). It can also include certain applications running directly on hardware platforms. Hardware-enforced, read-only media include, for example, Compact Disk-Recordable (CD-R)/Digital Video Disk-Recordable (DVD-R) disk drives and one-time programmable read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable read-only memory can be accepted as read-only media provided: (i) integrity can be adequately protected from the point of initial writing to the insertion of the memory into the information system; and (ii) there are reliable hardware protections against reprogramming the memory while installed in organizational information systems.