What it asks for. The organisation must define acceptable and unacceptable mobile code and mobile code technologies, and authorise, monitor and control the use of mobile code within the system.
In practice. Mobile code here means code delivered from remote sources and run locally, such as scripts in documents, browser-delivered code and macros. Good practice includes blocking Office macros from the internet, restricting script interpreters with policy, browser hardening and application control. Auditors look for policy settings, macro and script control configurations and evidence of monitoring for script abuse. Macro settings can allow signed macros from trusted publishers so that business needs are still met.
Common gaps. Macros and script hosts remain common initial access routes because restrictions were never applied or were relaxed for business convenience. Exceptions are rarely reviewed. Script activity is also seldom logged in enough detail to spot abuse.