CM-7(7) Code Execution in Protected Environments
Control enhancement of CM-7 Least Functionality
Control
Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: personnel or roles] when such code is:
Obtained from sources with limited or no warranty; and/or
Without the provision of source code.
Discussion
Code execution in protected environments applies to all sources of binary or machine-executable code, including commercial software and firmware and open-source software.
Related controls
Need CM-7(7) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.