SC-15 Collaborative Computing Devices and Applications has two parts. First, prohibit remote activation of collaborative computing devices and applications, with exceptions you define. Second, give an explicit indication of use to people physically present at the device.
NIST SP 800-53 binds US federal systems, and reaches contractors and cloud providers through contract terms such as FedRAMP. For everyone else it is a reference catalog you borrow from.
The guidance defines the scope: remote meeting devices and applications, networked whiteboards, cameras and microphones. The indication of use means signals to users when those devices are activated, such as a light on a camera or an on screen banner.
What it means in practice
Nobody should be able to switch on a conference room camera or a laptop microphone from afar without the people in the room knowing. The control allows exceptions, but you must name them. A helpdesk that needs to join a remote session is a typical exception, and the person at the machine should see a prompt and a visible sign.
Four enhancements add depth. SC-15.1 covers physical or logical disconnect, so a device can be cut off by a switch or a setting. SC-15.2 covers blocking inbound and outbound communications traffic. SC-15.3 covers disabling and removal in secure work areas. SC-15.4 asks you to explicitly indicate current participants.
Think through the exceptions list with care, because it is what an auditor will read first. A good entry has four parts: the device or application, the person or team allowed to start it remotely, the reason, and the control that keeps the user aware. For example, the IT helpdesk may start a remote support session on a laptop, but only after the laptop's user clicks accept and sees a persistent banner for the length of the session.
Hybrid work makes this control more relevant, not less. Home offices have smart speakers, cameras and TVs that are outside your management. You cannot inventory them, so your policy has to say what employees should do, and your tools should limit what a work laptop does with its own camera and microphone. A short employee guideline backed by device settings is a sound pairing.
Meeting platforms themselves matter too. Check whether your platform lets a host unmute a participant, whether recordings start automatically, and whether the platform announces recording to everyone in the room. These are all forms of remote activation and indication of use.
Evidence to collect
- The inventory of conference room devices, smart displays and meeting software.
- Settings for the meeting platform showing remote start or auto answer is off, or limited to named cases.
- The list of approved exceptions with an owner and a reason.
- Photos or screenshots of the indicator light or on screen banner in use.
- Device policy from your management tool that blocks camera and microphone access by default.
- A policy for secure rooms that bans or disables such devices where the work needs it.
Common gaps
Conference room hardware often ships with auto answer on, so a remote caller can dial in and see the room. Smart assistants and TVs with built in microphones sit in the same room and are missed in the inventory. Remote support tools get broad access with no prompt to the user. Participant lists are not shown, or guests can join with no record.
How to implement it
Turn off auto answer and remote start on every room device. Require a human to accept inbound meeting requests. Set your endpoint management tool to prompt for camera and microphone permission for each app. For remote support, configure the tool to ask for consent and display a banner.
Add a line item for these devices to the asset inventory. Review exceptions twice a year and remove any that no longer have a business reason. In secure areas, remove the devices or disable them physically and note it in the room's record.
Quick check
Does the indicator have to be hardware?
The guidance says explicit indication includes signals to users when devices are activated. A camera light and a clear on screen banner both fit. Show that users can see it.
Are remote support sessions allowed?
Only as exceptions you define. Keep the list and show that the user must consent.
