Requirement text: SC.2.178: Prohibit remote activation of collaborative computing devices and provide
indication of devices in use to users present at the device.
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Collaborative computing devices include networked white boards, cameras, and
microphones. Indication of use includes signals to users when collaborative computing
devices are activated. Dedicated video conferencing systems, which rely on one of the
participants calling or connecting to the other party to activate the video conference, are
excluded.
CMMC CLARIFICATION
You should configure collaborative computing devices so they cannot be activated remotely.
Examples of such devices are cameras, microphones, etc. All users should receive a
notification when a collaborative computing device is in use. Notification can include an
indicator light that turns on when in use, or a specific text window that appears on screen.
If a device does not have the means to alert a user when in use, the organization should
provide manual means. Manual means can include, as necessary:
• paper notification on entryways; and
• locking entryways when a collaborative computing device is in use.
Example
You are responsible for IT operations in your organization. Your organization has a group
of remote employees who collaborate using cameras and microphones attached to their
computers. You want to prevent the misuse of these devices. You disable the ability to turn
on cameras or microphones remotely on all devices. You also use a tool to alert users when
their cameras or microphones are turned on. Although remote activation is blocked, this
enables them to see if the devices were activated remotely. By doing this, you reduce the
likelihood of someone being able to turn these devices on and listen or view what your
employees are working on.
References
• NIST SP 800-171 Rev 1 3.13.12
• NIST CSF v1.1 PR.AC-3
• NIST SP 800-53 Rev 4 SC-15