Non-modifiable Executable Programs

frameworkNIST SP 800-53 Rev 5.2 sectionSC System and Communications Protection csf 2.0DE.CM-09 PR.PS-05 topics— frameworks0 0 2

Official textFor [Assignment: organization-defined system components], load and execute:
a. The operating environment from hardware-enforced, read-only media; and
b. The following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SC-34 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-09 PR.PS-05	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events; Installation and execution of unauthorized software are prevented	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping
ISO 27001	A.8.6 A.8.16 A.8.19 A.8.1	Capacity management; Monitoring activities…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping +1 more loosely related (not mappings) A.8.7 Protection against malware Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping
CIS v8.1	CIS 2.5 CIS 10.1 CIS 2.6 CIS 2.7	Allowlist Authorized Software; Deploy and Maintain Anti-Malware Software…	Loosely related	No mapping. Only shares CSF PR.PS-05, DE.CM-09: related, not a mapping +12 more loosely related (not mappings) CIS 10.2 Configure Automatic Anti-Malware Signature Updates Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping CIS 10.3 Disable Autorun and Autoplay for Removable Media Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping CIS 10.4 Configure Automatic Anti-Malware Scanning of Removable Media Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping CIS 10.5 Enable Anti-Exploitation Features Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping …and 8 more in the downloads
SOC 2	CC6.8 CC7.2	Preventing or detecting unauthorized or malicious software; Monitoring system components for anomalies	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping
PCI DSS	5.3.2 6.4.3 2.2.1 5.2.1	Periodic scans or continuous behavioural analysis; Payment page scripts authorised and integrity-checked…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping +6 more loosely related (not mappings) 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF DE.CM-09: related, not a mapping 10.3.4 File-integrity monitoring on logs Loosely related Only shares CSF DE.CM-09: related, not a mapping 11.3.1 Internal vulnerability scans every three months Loosely related Only shares CSF DE.CM-09: related, not a mapping 11.3.2 External ASV scans every three months Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 2 more in the downloads
CMMC	AC.L2-3.1.3 AU.L2-3.3.3 CA.L2-3.12.3 CM.L2-3.4.2	Control CUI Flow; Event Review…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping +8 more loosely related (not mappings) CM.L2-3.4.3 System Change Management Loosely related Only shares CSF DE.CM-09: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-09: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-09: related, not a mapping SC.L2-3.13.7 Split Tunneling Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 4 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.308(a)(8)	Information System Activity Review; Authorization and/or Supervision…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping +5 more loosely related (not mappings) §164.310(b) Workstation Use Loosely related Only shares CSF DE.CM-09: related, not a mapping §164.312(c) Integrity Loosely related Only shares CSF DE.CM-09: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Loosely related Only shares CSF DE.CM-09: related, not a mapping §164.312(e)(2)(i) Integrity Controls Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 1 more in the downloads
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.9 6.6 6.7	Protection against malicious and unauthorised software; Security patch management…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping
Essential Eight	ISM-0843 ISM-1488 ISM-1490 ISM-1544	Application control is implemented on workstations; Microsoft Office macros in files originating from the internet are blocked…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping +22 more loosely related (not mappings) ISM-1657 Application control restricts the execution of executables, libraries, scripts… Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping ISM-1870 Application control is applied to user profiles and temporary folders used by operating… Loosely related Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 18 more in the downloads
DORA	Art.9(1)Art.10(1)Art.10(3)	Protection and prevention; Detection…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 5	Malware protection	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.