SC-48 Sensor Relocation
All changes in this version
Title
Sensor Relocation
Control
Relocate [Assignment: sensors and monitoring capabilities] to [Assignment: locations] under the following conditions or circumstances: [Assignment: conditions or circumstances].
Discussion
Adversaries may take various paths and use different approaches as they move laterally through an organization (including its systems) to reach their target or as they attempt to exfiltrate information from the organization. The organization often only has a limited set of monitoring and detection capabilities, and they may be focused on the critical or likely infiltration or exfiltration paths. By using communications paths that the organization typically does not monitor, the adversary can increase its chances of achieving its desired goals. By relocating its sensors or monitoring capabilities to new locations, the organization can impede the adversary’s ability to achieve its goals. The relocation of the sensors or monitoring capabilities might be done based on threat information that the organization has acquired or randomly to confuse the adversary and make its lateral transition through the system or organization more challenging.
Parameters
sc-48_odp.01: sensors and monitoring capabilities
sc-48_odp.02: locations
sc-48_odp.03: conditions or circumstances
Related controls
au-2, sc-7, si-4
Assessment objective
SC-48 [Assignment: sensors and monitoring capabilities] are relocated to [Assignment: locations] under [Assignment: conditions or circumstances].
STIG rules that implement this control 0
No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).