Skip to content

Mobile Code

What is Mobile Code?

Software transferred across a network and executed on a local system, such as Java applets and scripts, requiring security controls.

Information Security

Frameworks that govern mobile code

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on mobile code

Requirements naming mobile code across 6 standards, quoted from the control text.

NIST SP 800-53 Rev 56 controls

Allow execution of permitted mobile code only in confined virtual machine environments.

NIST800-SC-18(5) · SC-18(5) Mobile Code | Allow Execution Only in Confined Environments →
IEC 624435 controls

A network device shall enforce usage restrictions on mobile code it can execute or transfer; RE 1 integrity check. The identifier is named in the held IIC SMM mapping list; the 4-2 text is not held.

iec-62443::NDR 2.4 · Mobile code (network device) →
DISA Security Technical Implementation Guides (STIGs)3 controls

Application code scanners, which analyse source, binary or byte code for security flaws, malicious code and back doors, must be used whenever possible and particularly in development so flagged code is remediated before release, with mitigations such as IDS or...

disa-security-technical-implementation-guides-stigs::SRG-9 · SRG-9 ASD general requirements: code scanners whenever possible, application scanners regularly, mobile code by category →
FBI CJIS Security Policy2 controls

Define acceptable and unacceptable mobile code and mobile code technologies, and authorise, monitor and control the use of mobile code within the system.

fbi-cjis-security-policy::SC-18 · SC-18 Mobile Code →
API 11641 control

The plan must require a risk assessment, using the impact assessment, of the use of mobile code in an IAC cyber environment, approval by authorised personnel before any use, use only per vendor recommended practices, and monitoring of mobile code execution in...

api-1164::DE.CM-5 · DE.CM-5 Mobile code risk-assessed, approved and monitored →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)1 control

Set up a framework for hardening mobile devices and mobile code, including the criteria for accepting them and the policies and procedures that have been approved.

awwa-cybersecurity-guidance-for-the-water-sector-american-water-works-association::SC-11 · SC-11 Hardening of mobile code and devices →

Questions people ask about mobile code

What is Mobile Code?
Software transferred across a network and executed on a local system, such as Java applets and scripts, requiring security controls.
Why is Mobile Code important for compliance?
Mobile Code is a key concept in Information Security. Understanding mobile code helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Mobile Code?
Mobile Code appears in the requirement text of NIST SP 800-53 Rev 5, IEC 62443, DISA Security Technical Implementation Guides (STIGs), FBI CJIS Security Policy, API 1164. Across these standards we have identified 18 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Mobile Code?
Explore our compliance framework pages to see how mobile code applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Mobile Code applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.