SC-42 has two parts. Prohibit remote activation of the sensing capabilities you name, and provide an explicit indication of sensor use to the people or roles you name. NIST applies it mainly to mobile devices, which carry microphones, cameras, GPS and accelerometers.
800-53 binds federal systems and contractors. For others it is a good reference for mobile device and privacy questions.
What it means in practice
The risk, as NIST puts it, is covert activation. Remotely turning on a phone's GPS could track a person. The control asks that sensors not be activated remotely without authorization and that users can see when a sensor is in use. The indicator can be the operating system light or icon, or a notice in your own app.
Several enhancements apply. SC-42(1) Reporting to Authorized Individuals or Roles, SC-42(2) Authorized Use, SC-42(3) Prohibit Use of Devices, SC-42(4) Notice of Collection, and SC-42(5) Collection Minimization. The last two matter if you ship an app.
Evidence to collect
- Mobile device management settings for camera and microphone control.
- A policy stating who may activate sensors remotely and why.
- For apps you build, permission prompts, privacy notices and a data map of what each sensor collects.
Common gaps
Remote management agents with broad sensor rights nobody reviewed. App permissions requested but not needed.
How to implement it
Audit what your device management tool can do, remove what you do not use, and request only the permissions your app needs.
Quick check
What does the indication requirement mean?
Users or defined roles must be able to tell when a sensor is in use.
