Collaborative Computing Devices and Applications SC-15

System and Communications Protection · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SC-15 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-15 (Collaborative Computing Devices and Applications) is about stopping cameras, microphones, and screen-sharing or meeting tools from being switched on remotely without the people nearby knowing. It has two parts: prohibit remote activation of these devices and applications (except for a short, named list of allowed exceptions), and give an explicit signal — an indicator light or an on-screen notice — to anyone physically present when a device is in use. It is a Low-baseline control, so it applies even to a modest server or workstation.

What good looks like

Block remote activation of cameras, microphones, and screen-sharing or meeting software — a person nearby should be the one who starts them.
Keep a short, written list of allowed exceptions (for example, a sanctioned remote-support tool) and nothing beyond it.
When a collaborative device is live, show it plainly — an indicator light or an on-screen banner — so people in the room know.
On a headless server, the cleanest control is absence: do not install conferencing, camera, or microphone software at all.
Check for listening services that could expose a camera or microphone, and remove or disable what you find.

Framework mapping

NIST CSF 2.0 — PR.IR-01 — Networks and environments are protected from unauthorized logical access and usage

How to move it toward Implemented

Confirm no conferencing or media-capture packages are installed (dpkg -l | grep -Ei 'zoom|teams|jitsi|webrtc' on Debian or Ubuntu) and remove any that are not needed.
List the services and sockets that are listening (ss -tulpn) and confirm none are exposing a camera, microphone, or meeting service.
If the server has no camera or microphone hardware, record that — ‘no collaborative computing devices present’ is a valid, defensible answer for this control.
Write the one-line exceptions policy (which remote tools, if any, are allowed, and who approved them), saved as a dated file.
Attach that check and policy as hardening evidence on the asset, naming SC-15 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.