SC-15 Collaborative Computing Devices and Applications
Review SC-15
1. Set its parameters
No parameters to set for SC-15.
2. Record its status
a.Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed] ; and
b.Provide an explicit indication of use to users physically present at the devices.
Discussion
Collaborative computing devices and applications include remote meeting devices and applications, networked white boards, cameras, and microphones. The explicit indication of use includes signals to users when collaborative computing devices and applications are activated.
Enhancements
Review SC-15(1)
1. Set its parameters
No parameters to set for SC-15(1).
2. Record its status
Provide [Selection (one-or-more): physical; logical] disconnect of collaborative computing devices in a manner that supports ease of use.
Discussion
Failing to disconnect from collaborative computing devices can result in subsequent compromises of organizational information. Providing easy methods to disconnect from such devices after a collaborative computing session ensures that participants carry out the disconnect activity without having to go through complex and tedious procedures. Disconnect from collaborative computing devices can be manual or automatic.
Review SC-15(3)
1. Set its parameters
No parameters to set for SC-15(3).
2. Record its status
Disable or remove collaborative computing devices and applications from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].
Discussion
Failing to disable or remove collaborative computing devices and applications from systems or system components can result in compromises of information, including eavesdropping on conversations. A Sensitive Compartmented Information Facility (SCIF) is an example of a secure work area.
Review SC-15(4)
1. Set its parameters
No parameters to set for SC-15(4).
2. Record its status
Provide an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences].
Discussion
Explicitly indicating current participants prevents unauthorized individuals from participating in collaborative computing sessions without the explicit knowledge of other participants.
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
* does not fully satisfy the intent of this control (per NIST's mapping notes).