# SC-34 Non-modifiable Executable Programs

NIST SP 800-53 control. Family: SC System and Communications Protection. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: For [Assignment: organization-defined system components], load and execute: a. The operating environment from hardware-enforced, read-only media; and b. The following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications].
Guidance: The operating environment for a system contains the code that hosts applications, including operating systems, executives, or virtual machine monitors (i.e., hypervisors). It can also include certain applications that run directly on hardware platforms. Hardware-enforced, read-only media include Compact Disc-Recordable (CD-R) and Digital Versatile Disc-Recordable (DVD-R) disk drives as well as one-time, programmable, read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable, read-only memory can be accepted as read-only media provided that integrity can be adequately protected from the point of initial writing to the insertion of the memory into the system, and there are reliable hardware protections against reprogramming the memory while installed in organizational systems.

## Enhancements (2)
- SC-34(01) No Writable Storage
- SC-34(02) Integrity Protection on Read-only Media
Withdrawn by NIST: SC-34(03) (now in SC-51).
Each enhancement's statement: /api/v1/controls/SC-34?fields=enhancements

## Clauses by framework (9 frameworks)
- pci_dss_v4: 5.2
- nist_csf_2: DE.CM-09, PR.PS-05
- finma_circular: IV.C(64), IV.D(72)
- rbi_csf: Annex1.5
- fisc: FISC.T7
- cra: CRA.I.2k
- pci_pts: B
- fips_140: FIPS 140-3 §7.5
- fda_cyber: SA-3
OSA's mapping for nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SC-34
- Clauses only: /api/v1/controls/SC-34?fields=mappings
- Page for people: /controls/sc-34/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.