NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| SC-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy that: | |
| SC-02 | Separation of System and User Functionality | Separate user functionality, including user interface services, from system management functionality. | |
| SC-02(01) in SC-2 |
Interfaces for Non-privileged Users | Prevent the presentation of system management functionality at interfaces to non-privileged users. | |
| SC-02(02) in SC-2 |
Disassociability | Store state information from applications and software separately. | |
| SC-03 | Security Function Isolation | Isolate security functions from nonsecurity functions. | |
| SC-03(01) in SC-3 |
Hardware Separation | Employ hardware separation mechanisms to implement security function isolation. | |
| SC-03(02) in SC-3 |
Access and Flow Control Functions | Isolate security functions enforcing access and information flow control from nonsecurity functions and from other security functions. | |
| SC-03(03) in SC-3 |
Minimize Nonsecurity Functionality | Minimize the number of nonsecurity functions included within the isolation boundary containing security functions. | |
| SC-03(04) in SC-3 |
Module Coupling and Cohesiveness | Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules. | |
| SC-03(05) in SC-3 |
Layered Structures | Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers. | |
| SC-04 | Information in Shared System Resources | Prevent unauthorized and unintended information transfer via shared system resources. | |
| SC-04(01) in SC-4 |
Security Levels withdrawn | ||
| SC-04(02) in SC-4 |
Multilevel or Periods Processing | Prevent unauthorized information transfer via shared resources in accordance with [Assignment: procedures] when system processing explicitly switches between different information classification levels or security categories. | |
| SC-05 | Denial-of-service Protection | a. [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignment: types of denial-of-service events] ; and b. Employ the following controls to achieve the denial-of-service objective: [Assig | |
| SC-05(01) in SC-5 |
Restrict Ability to Attack Other Systems | Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignment: denial-of-service attacks]. | |
| SC-05(02) in SC-5 |
Capacity, Bandwidth, and Redundancy | Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks. | |
| SC-05(03) in SC-5 |
Detection and Monitoring | (a) Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [Assignment: monitoring tools] ; and (b) Monitor the following system resources to determine if sufficient re | |
| SC-06 | Resource Availability | Protect the availability of resources by allocating [Assignment: resources] by [Selection (one or more): priority; quota; {{ insert: param, sc-06_odp.03 }} ]. | |
| SC-07 | Boundary Protection | a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system components that are [Selection: physica | |
| SC-07(01) in SC-7 |
Physically Separated Subnetworks withdrawn | ||
| SC-07(02) in SC-7 |
Public Access withdrawn | ||
| SC-07(03) in SC-7 |
Access Points | Limit the number of external network connections to the system. | |
| SC-07(04) in SC-7 |
External Telecommunications Services | (a) Implement a managed interface for each external telecommunication service; (b) Establish a traffic flow policy for each managed interface; (c) Protect the confidentiality and integrity of the information being transmitted across each in | |
| SC-07(05) in SC-7 |
Deny by Default — Allow by Exception | Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ]. | |
| SC-07(06) in SC-7 |
Response to Recognized Failures withdrawn | ||
| SC-07(07) in SC-7 |
Split Tunneling for Remote Devices | Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: safeguards]. | |
| SC-07(08) in SC-7 |
Route Traffic to Authenticated Proxy Servers | Route [Assignment: internal communications traffic] to [Assignment: external networks] through authenticated proxy servers at managed interfaces. | |
| SC-07(09) in SC-7 |
Restrict Threatening Outgoing Communications Traffic | (a) Detect and deny outgoing communications traffic posing a threat to external systems; and (b) Audit the identity of internal users associated with denied communications. | |
| SC-07(10) in SC-7 |
Prevent Exfiltration | (a) Prevent the exfiltration of information; and (b) Conduct exfiltration tests [Assignment: frequency]. | |
| SC-07(11) in SC-7 |
Restrict Incoming Communications Traffic | Only allow incoming communications from [Assignment: authorized sources] to be routed to [Assignment: authorized destinations]. | |
| SC-07(12) in SC-7 |
Host-based Protection | Implement [Assignment: host-based boundary protection mechanisms] at [Assignment: system components]. | |
| SC-07(13) in SC-7 |
Isolation of Security Tools, Mechanisms, and Support Components | Isolate [Assignment: information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system. | |
| SC-07(14) in SC-7 |
Protect Against Unauthorized Physical Connections | Protect against unauthorized physical connections at [Assignment: managed interfaces]. | |
| SC-07(15) in SC-7 |
Networked Privileged Accesses | Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing. | |
| SC-07(16) in SC-7 |
Prevent Discovery of System Components | Prevent the discovery of specific system components that represent a managed interface. | |
| SC-07(17) in SC-7 |
Automated Enforcement of Protocol Formats | Enforce adherence to protocol formats. | |
| SC-07(18) in SC-7 |
Fail Secure | Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device. | |
| SC-07(19) in SC-7 |
Block Communication from Non-organizationally Configured Hosts | Block inbound and outbound communications traffic between [Assignment: communication clients] that are independently configured by end users and external service providers. | |
| SC-07(20) in SC-7 |
Dynamic Isolation and Segregation | Provide the capability to dynamically isolate [Assignment: system components] from other system components. | |
| SC-07(21) in SC-7 |
Isolation of System Components | Employ boundary protection mechanisms to isolate [Assignment: system components] supporting [Assignment: missions and/or business functions]. | |
| SC-07(22) in SC-7 |
Separate Subnets for Connecting to Different Security Domains | Implement separate network addresses to connect to systems in different security domains. | |
| SC-07(23) in SC-7 |
Disable Sender Feedback on Protocol Validation Failure | Disable feedback to senders on protocol format validation failure. | |
| SC-07(24) in SC-7 |
Personally Identifiable Information | For systems that process personally identifiable information: (a) Apply the following processing rules to data elements of personally identifiable information: [Assignment: processing rules]; (b) Monitor for permitted processing at the exte | |
| SC-07(25) in SC-7 |
Unclassified National Security System Connections | Prohibit the direct connection of [Assignment: unclassified national security system] to an external network without the use of [Assignment: boundary protection device]. | |
| SC-07(26) in SC-7 |
Classified National Security System Connections | Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: boundary protection device]. | |
| SC-07(27) in SC-7 |
Unclassified Non-national Security System Connections | Prohibit the direct connection of [Assignment: unclassified, non-national security system] to an external network without the use of [Assignment: boundary protection device]. | |
| SC-07(28) in SC-7 |
Connections to Public Networks | Prohibit the direct connection of [Assignment: system] to a public network. | |
| SC-07(29) in SC-7 |
Separate Subnets to Isolate Functions | Implement [Selection: physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: critical system components and functions]. | |
| SC-08 | Transmission Confidentiality and Integrity | Protect the [Selection (one or more): confidentiality; integrity] of transmitted information. | |
| SC-08(01) in SC-8 |
Cryptographic Protection | Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission. | |
| SC-08(02) in SC-8 |
Pre- and Post-transmission Handling | Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception. | |
| SC-08(03) in SC-8 |
Cryptographic Protection for Message Externals | Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: alternative physical controls]. | |
| SC-08(04) in SC-8 |
Conceal or Randomize Communications | Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: alternative physical controls]. | |
| SC-08(05) in SC-8 |
Protected Distribution System | Implement [Assignment: protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission. | |
| SC-09 | Transmission Confidentiality withdrawn | ||
| SC-10 | Network Disconnect | Terminate the network connection associated with a communications session at the end of the session or after [Assignment: time period] of inactivity. | |
| SC-11 | Trusted Path | a. Provide a [Selection: physically; logically] isolated trusted communications path for communications between the user and the trusted components of the system; and b. Permit users to invoke the trusted communications path for communicati | |
| SC-11(01) in SC-11 |
Irrefutable Communications Path | (a) Provide a trusted communications path that is irrefutably distinguishable from other communications paths; and (b) Initiate the trusted communications path for communications between the [Assignment: security functions] of the system an | |
| SC-12 | Cryptographic Key Establishment and Management | Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: requirements]. | |
| SC-12(01) in SC-12 |
Availability | Maintain availability of information in the event of the loss of cryptographic keys by users. | |
| SC-12(02) in SC-12 |
Symmetric Keys | Produce, control, and distribute symmetric cryptographic keys using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes. | |
| SC-12(03) in SC-12 |
Asymmetric Keys | Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved | |
| SC-12(04) in SC-12 |
PKI Certificates withdrawn | ||
| SC-12(05) in SC-12 |
PKI Certificates / Hardware Tokens withdrawn | ||
| SC-12(06) in SC-12 |
Physical Control of Keys | Maintain physical control of cryptographic keys when stored information is encrypted by external service providers. | |
| SC-13 | Cryptographic Protection | a. Determine the [Assignment: cryptographic uses] ; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: types of cryptography]. | |
| SC-13(01) in SC-13 |
FIPS-validated Cryptography withdrawn | ||
| SC-13(02) in SC-13 |
NSA-approved Cryptography withdrawn | ||
| SC-13(03) in SC-13 |
Individuals Without Formal Access Approvals withdrawn | ||
| SC-13(04) in SC-13 |
Digital Signatures withdrawn | ||
| SC-14 | Public Access Protections withdrawn | ||
| SC-15 | Collaborative Computing Devices and Applications | a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: exceptions where remote activation is to be allowed] ; and b. Provide an explicit indication of use to users physi | |
| SC-15(01) in SC-15 |
Physical or Logical Disconnect | Provide [Selection (one or more): physical; logical] disconnect of collaborative computing devices in a manner that supports ease of use. | |
| SC-15(02) in SC-15 |
Blocking Inbound and Outbound Communications Traffic withdrawn | ||
| SC-15(03) in SC-15 |
Disabling and Removal in Secure Work Areas | Disable or remove collaborative computing devices and applications from [Assignment: systems or system components] in [Assignment: secure work areas]. | |
| SC-15(04) in SC-15 |
Explicitly Indicate Current Participants | Provide an explicit indication of current participants in [Assignment: online meetings and teleconferences]. | |
| SC-16 | Transmission of Security and Privacy Attributes | Associate [Assignment: organization-defined security and privacy attributes] with information exchanged between systems and between system components. | |
| SC-16(01) in SC-16 |
Integrity Verification | Verify the integrity of transmitted security and privacy attributes. | |
| SC-16(02) in SC-16 |
Anti-spoofing Mechanisms | Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process. | |
| SC-16(03) in SC-16 |
Cryptographic Binding | Implement [Assignment: mechanisms or techniques] to bind security and privacy attributes to transmitted information. | |
| SC-17 | Public Key Infrastructure Certificates | a. Issue public key certificates under an [Assignment: certificate policy] or obtain public key certificates from an approved service provider; and b. Include only approved trust anchors in trust stores or certificate stores managed by the | |
| SC-18 | Mobile Code | a. Define acceptable and unacceptable mobile code and mobile code technologies; and b. Authorize, monitor, and control the use of mobile code within the system. | |
| SC-18(01) in SC-18 |
Identify Unacceptable Code and Take Corrective Actions | Identify [Assignment: unacceptable mobile code] and take [Assignment: corrective actions]. | |
| SC-18(02) in SC-18 |
Acquisition, Development, and Use | Verify that the acquisition, development, and use of mobile code to be deployed in the system meets [Assignment: mobile code requirements]. | |
| SC-18(03) in SC-18 |
Prevent Downloading and Execution | Prevent the download and execution of [Assignment: unacceptable mobile code]. | |
| SC-18(04) in SC-18 |
Prevent Automatic Execution | Prevent the automatic execution of mobile code in [Assignment: software applications] and enforce [Assignment: actions] prior to executing the code. | |
| SC-18(05) in SC-18 |
Allow Execution Only in Confined Environments | Allow execution of permitted mobile code only in confined virtual machine environments. | |
| SC-19 | Voice Over Internet Protocol withdrawn | Technology-specific; addressed as any other technology or protocol. | |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and b. Provide the means to | |
| SC-20(01) in SC-20 |
Child Subspaces withdrawn | ||
| SC-20(02) in SC-20 |
Data Origin and Integrity | Provide data origin and integrity protection artifacts for internal name/address resolution queries. | |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources. | |
| SC-21(01) in SC-21 |
Data Origin and Integrity withdrawn | ||
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation. | |
| SC-23 | Session Authenticity | Protect the authenticity of communications sessions. | |
| SC-23(01) in SC-23 |
Invalidate Session Identifiers at Logout | Invalidate session identifiers upon user logout or other session termination. | |
| SC-23(02) in SC-23 |
User-initiated Logouts and Message Displays withdrawn | ||
| SC-23(03) in SC-23 |
Unique System-generated Session Identifiers | Generate a unique session identifier for each session with [Assignment: randomness requirements] and recognize only session identifiers that are system-generated. | |
| SC-23(04) in SC-23 |
Unique Session Identifiers with Randomization withdrawn | ||
| SC-23(05) in SC-23 |
Allowed Certificate Authorities | Only allow the use of [Assignment: certificated authorities] for verification of the establishment of protected sessions. | |
| SC-24 | Fail in Known State | Fail to a [Assignment: known system state] for the following failures on the indicated components while preserving [Assignment: system state information] in failure: [Assignment: types of system failures on system components]. | |
| SC-25 | Thin Nodes | Employ minimal functionality and information storage on the following system components: [Assignment: system components]. | |
| SC-26 | Decoys | Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks. | |
| SC-26(01) in SC-26 |
Detection of Malicious Code withdrawn | ||
| SC-27 | Platform-independent Applications | Include within organizational systems the following platform independent applications: [Assignment: platform-independent applications]. | |
| SC-28 | Protection of Information at Rest | Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: information at rest]. | |
| SC-28(01) in SC-28 |
Cryptographic Protection | Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: system components or media]: [Assignment: information]. | |
| SC-28(02) in SC-28 |
Offline Storage | Remove the following information from online storage and store offline in a secure location: [Assignment: information]. | |
| SC-28(03) in SC-28 |
Cryptographic Keys | Provide protected storage for cryptographic keys [Selection: {{ insert: param, sc-28.03_odp.02 }} ; hardware-protected key store]. | |
| SC-29 | Heterogeneity | Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: system components]. | |
| SC-29(01) in SC-29 |
Virtualization Techniques | Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed [Assignment: frequency]. | |
| SC-30 | Concealment and Misdirection | Employ the following concealment and misdirection techniques for [Assignment: systems] at [Assignment: time periods] to confuse and mislead adversaries: [Assignment: concealment and misdirection techniques]. | |
| SC-30(01) in SC-30 |
Virtualization Techniques withdrawn | ||
| SC-30(02) in SC-30 |
Randomness | Employ [Assignment: techniques] to introduce randomness into organizational operations and assets. | |
| SC-30(03) in SC-30 |
Change Processing and Storage Locations | Change the location of [Assignment: processing and/or storage] [Selection: {{ insert: param, sc-30.03_odp.03 }} ; random time intervals]]. | |
| SC-30(04) in SC-30 |
Misleading Information | Employ realistic, but misleading information in [Assignment: system components] about its security state or posture. | |
| SC-30(05) in SC-30 |
Concealment of System Components | Employ the following techniques to hide or conceal [Assignment: system components]: [Assignment: techniques]. | |
| SC-31 | Covert Channel Analysis | a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and b. Estimate the maximum bandwidth of those cha | |
| SC-31(01) in SC-31 |
Test Covert Channels for Exploitability | Test a subset of the identified covert channels to determine the channels that are exploitable. | |
| SC-31(02) in SC-31 |
Maximum Bandwidth | Reduce the maximum bandwidth for identified covert [Selection (one or more): storage; timing] channels to [Assignment: values]. | |
| SC-31(03) in SC-31 |
Measure Bandwidth in Operational Environments | Measure the bandwidth of [Assignment: subset of identified covert channels] in the operational environment of the system. | |
| SC-32 | System Partitioning | Partition the system into [Assignment: system components] residing in separate [Selection: physical; logical] domains or environments based on [Assignment: circumstances for the physical or logical separation of components]. | |
| SC-32(01) in SC-32 |
Separate Physical Domains for Privileged Functions | Partition privileged functions into separate physical domains. | |
| SC-33 | Transmission Preparation Integrity withdrawn | ||
| SC-34 | Non-modifiable Executable Programs | For [Assignment: system components] , load and execute: a. The operating environment from hardware-enforced, read-only media; and b. The following applications from hardware-enforced, read-only media: [Assignment: applications]. | |
| SC-34(01) in SC-34 |
No Writable Storage | Employ [Assignment: system components] with no writeable storage that is persistent across component restart or power on/off. | |
| SC-34(02) in SC-34 |
Integrity Protection on Read-only Media | Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media. | |
| SC-34(03) in SC-34 |
Hardware-based Protection withdrawn | ||
| SC-35 | External Malicious Code Identification | Include system components that proactively seek to identify network-based malicious code or malicious websites. | |
| SC-36 | Distributed Processing and Storage | Distribute the following processing and storage components across multiple [Selection: physical locations; logical domains]: [Assignment: organization-defined processing and storage components]. | |
| SC-36(01) in SC-36 |
Polling Techniques | (a) Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: [Assignment: distributed processing and storage components] ; and (b) Take the following actions in respo | |
| SC-36(02) in SC-36 |
Synchronization | Synchronize the following duplicate systems or system components: [Assignment: duplicate systems or system components]. | |
| SC-37 | Out-of-band Channels | Employ the following out-of-band channels for the physical delivery or electronic transmission of [Assignment: information, system components, or devices] to [Assignment: individuals or systems]: [Assignment: out-of-band channels]. | |
| SC-37(01) in SC-37 |
Ensure Delivery and Transmission | Employ [Assignment: controls] to ensure that only [Assignment: individuals or systems] receive the following information, system components, or devices: [Assignment: information, system components, or devices]. | |
| SC-38 | Operations Security | Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [Assignment: operations security controls]. | |
| SC-39 | Process Isolation | Maintain a separate execution domain for each executing system process. | |
| SC-39(01) in SC-39 |
Hardware Separation | Implement hardware separation mechanisms to facilitate process isolation. | |
| SC-39(02) in SC-39 |
Separate Execution Domain Per Thread | Maintain a separate execution domain for each thread in [Assignment: multi-threaded processing]. | |
| SC-40 | Wireless Link Protection | Protect external and internal [Assignment: organization-defined wireless links] from the following signal parameter attacks: [Assignment: organization-defined types of signal parameter attacks or references to sources for such attacks]. | |
| SC-40(01) in SC-40 |
Electromagnetic Interference | Implement cryptographic mechanisms that achieve [Assignment: level of protection] against the effects of intentional electromagnetic interference. | |
| SC-40(02) in SC-40 |
Reduce Detection Potential | Implement cryptographic mechanisms to reduce the detection potential of wireless links to [Assignment: level of reduction]. | |
| SC-40(03) in SC-40 |
Imitative or Manipulative Communications Deception | Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters. | |
| SC-40(04) in SC-40 |
Signal Parameter Identification | Implement cryptographic mechanisms to prevent the identification of [Assignment: wireless transmitters] by using the transmitter signal parameters. | |
| SC-41 | Port and I/O Device Access | [Selection: physically; logically] disable or remove [Assignment: connection ports or input/output devices] on the following systems or system components: [Assignment: systems or system components]. | |
| SC-42 | Sensor Capability and Data | a. Prohibit [Selection (one or more): the use of devices possessing {{ insert: param, sc-42_odp.02 }} in {{ insert: param, sc-42_odp.03 }} ; the remote activation of environmental sensing capabilities on organizational systems or system com | |
| SC-42(01) in SC-42 |
Reporting to Authorized Individuals or Roles | Verify that the system is configured so that data or information collected by the [Assignment: sensors] is only reported to authorized individuals or roles. | |
| SC-42(02) in SC-42 |
Authorized Use | Employ the following measures so that data or information collected by [Assignment: sensors] is only used for authorized purposes: [Assignment: measures]. | |
| SC-42(03) in SC-42 |
Prohibit Use of Devices withdrawn | ||
| SC-42(04) in SC-42 |
Notice of Collection | Employ the following measures to facilitate an individual’s awareness that personally identifiable information is being collected by [Assignment: sensors]: [Assignment: measures]. | |
| SC-42(05) in SC-42 |
Collection Minimization | Employ [Assignment: sensors] that are configured to minimize the collection of information about individuals that is not needed. | |
| SC-43 | Usage Restrictions | a. Establish usage restrictions and implementation guidelines for the following system components: [Assignment: components] ; and b. Authorize, monitor, and control the use of such components within the system. | |
| SC-44 | Detonation Chambers | Employ a detonation chamber capability within [Assignment: system, system component, or location]. | |
| SC-45 | System Time Synchronization | Synchronize system clocks within and between systems and system components. | |
| SC-45(01) in SC-45 |
Synchronization with Authoritative Time Source | (a) Compare the internal system clocks [Assignment: frequency] with [Assignment: authoritative time source] ; and (b) Synchronize the internal system clocks to the authoritative time source when the time difference is greater than [Assignme | |
| SC-45(02) in SC-45 |
Secondary Authoritative Time Source | (a) Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source; and (b) Synchronize the internal system clocks to the secondary authoritative time source if the primary | |
| SC-46 | Cross Domain Policy Enforcement | Implement a policy enforcement mechanism [Selection: physically; logically] between the physical and/or network interfaces for the connecting security domains. | |
| SC-47 | Alternate Communications Paths | Establish [Assignment: alternate communication paths] for system operations organizational command and control. | |
| SC-48 | Sensor Relocation | Relocate [Assignment: sensors and monitoring capabilities] to [Assignment: locations] under the following conditions or circumstances: [Assignment: conditions or circumstances]. | |
| SC-48(01) in SC-48 |
Dynamic Relocation of Sensors or Monitoring Capabilities | Dynamically relocate [Assignment: sensors and monitoring capabilities] to [Assignment: locations] under the following conditions or circumstances: [Assignment: conditions or circumstances]. | |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | Implement hardware-enforced separation and policy enforcement mechanisms between [Assignment: security domains]. | |
| SC-50 | Software-enforced Separation and Policy Enforcement | Implement software-enforced separation and policy enforcement mechanisms between [Assignment: security domains]. | |
| SC-51 | Hardware-based Protection | a. Employ hardware-based, write-protect for [Assignment: system firmware components] ; and b. Implement specific procedures for [Assignment: authorized individuals] to manually disable hardware write-protect for firmware modifications and r |
162 of 1196.