SC.L2-3.13.12  

Reference: CMMC v2.13

Family: SC

Level Introduced: 2

Title: Collaborative Device Control

Practice:
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

Further Discussion:
Notification that a device is in use can include an indicator light that turns on or a specific text window that appears on screen. If a device does not have the means to alert a user when in use, the organization should provide manual means. Manual means can include, as necessary:
• paper notification on entryways; and
• locking entryways when a collaborative computing device is in use.
This requirement is not intended to include technologies that enable users to share the contents of their computer screens via the internet.

Example
A group of remote employees at your company routinely collaborate using cameras and microphones attached to their computers [a]. To prevent the misuse of these devices, you disable the ability to turn on cameras or microphones remotely [c]. You ensure the machines alert users when the camera or microphone are in use with a light beside the camera and an onscreen notification [b]. Although remote activation is blocked, this enables users to see if the devices are active.

Potential Assessment Considerations
• Are the collaborative computing devices configured to provide indication to users when in use (e.g., a light, text notification, or audio tone) or are users alerted before entering a space (e.g., written notice posted outside the space) where they are in use [b]?
• Are the collaborative computing devices configured to prevent them from being turned on without user interaction or consent [c]?

Source: CMMC v2.13