sc-42-sensor-capability-and-data

name	SC-42_sensor-capability-and-data
description	Prohibit [organization-defined] ;
category	configuration
version	5.2.0
author	cyberstrike-official
tags	["nist","sp800-53","rev5","sc-42","sc"]
tech_stack	["aws","azure","gcp","linux","windows","network"]
cwe_ids	["CWE-311"]
chains_with	["SC-15"]
prerequisites	[]
severity_boost	{"SC-15":"Chain with SC-15 for comprehensive security coverage"}

SC-42 Sensor Capability and Data

High-Level Description

Family: System and Communications Protection (SC) Framework: NIST SP 800-53 Rev 5

Sensor capability and data applies to types of systems or system components characterized as mobile devices, such as cellular telephones, smart phones, and tablets. Mobile devices often include sensors that can collect and record data regarding the environment where the system is in use. Sensors that are embedded within mobile devices include microphones, cameras, Global Positioning System (GPS) mechanisms, and accelerometers. While the sensors on mobiles devices provide an important function, if activated covertly, such devices can potentially provide a means for adversaries to learn valuable information about individuals and organizations. For example, remotely activating the GPS function on a mobile device could provide an adversary with the ability to track the movements of an individual. Organizations may prohibit individuals from bringing cellular telephones or digital cameras into certain designated facilities or controlled areas within facilities where classified information is stored or sensitive conversations are taking place.

What to Check

• Verify SC-42 Sensor Capability and Data is documented in SSP
• Validate all 2 control requirements are implemented
• Confirm control is operating effectively
• Review evidence of continuous monitoring for SC-42

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for SC-42 implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Check encryption and network controls	cloud_audit_encryption
nmap	Network scanning