| When dealing with access restrictions pertaining to change control, it should be noted that, any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
Rationale for non-applicability: This vulnerability is better addressed by implementing CCI-000370, which states the mobile operating system must employ the capability of a Mobile Device Manager (MDM) to centrally manage configuration settings, including security policies. These security policies include policy related to discretionary access controls. |
