SC System and Communications Protection

Control

1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
   1. [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
   2. Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls;
2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and
3. Review and update the current system and communications protection:
   1. Policy [Assignement: frequency] and following [Assignement: events] ; and
   2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Assessment Objective

1. 1. a system and communications protection policy is developed and documented;
   2. the system and communications protection policy is disseminated to [Assignement: personnel or roles];
   3. system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented;
   4. the system and communications protection procedures are disseminated to [Assignement: personnel or roles];
   5. 1. 1. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses purpose;
         2. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses scope;
         3. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses roles;
         4. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses responsibilities;
         5. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses management commitment;
         6. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses coordination among organizational entities;
         7. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business-process-level; system-level] system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures;
3. 1. 1. the current system and communications protection policy is reviewed and updated [Assignement: frequency];
      2. the current system and communications protection policy is reviewed and updated following [Assignement: events];
   2. 1. the current system and communications protection procedures are reviewed and updated [Assignement: frequency];
      2. the current system and communications protection procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. unauthorized information transfer via shared system resources is prevented;
2. unintended information transfer via shared system resources is prevented.

Assessment Method

Examine

Interview

Control

1. [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignement: types of denial-of-service events] ; and
2. Employ the following controls to achieve the denial-of-service objective: [Assignement: controls by type of denial-of-service event].

Discussion

Assessment Objective

1. the effects of [Assignement: types of denial-of-service events] are [Selection: protect against; limit];
2. [Assignement: controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
2. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
3. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Discussion

Assessment Objective

1. 1. communications at external managed interfaces to the system are monitored;
   2. communications at external managed interfaces to the system are controlled;
   3. communications at key internal managed interfaces within the system are monitored;
   4. communications at key internal managed interfaces within the system are controlled;
2. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks;
3. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Provide a [Selection: physically; logically] isolated trusted communications path for communications between the user and the trusted components of the system; and
2. Permit users to invoke the trusted communications path for communications between the user and the following security functions of the system, including at a minimum, authentication and re-authentication: [Assignement: security functions].

Discussion

Control

Discussion

Assessment Objective

1. cryptographic keys are established when cryptography is employed within the system in accordance with [Assignement: requirements];
2. cryptographic keys are managed when cryptography is employed within the system in accordance with [Assignement: requirements].

Assessment Method

Examine

Interview

Control

1. Determine the [Assignement: cryptographic uses] ; and
2. Implement the following types of cryptography required for each specified cryptographic use: [Assignement: types of cryptography].

Discussion

Assessment Objective

1. [Assignement: cryptographic uses] are identified;
2. [Assignement: types of cryptography] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignement: exceptions where remote activation is to be allowed] ; and
2. Provide an explicit indication of use to users physically present at the devices.

Discussion

Assessment Objective

1. remote activation of collaborative computing devices and applications is prohibited except [Assignement: exceptions where remote activation is to be allowed];
2. an explicit indication of use is provided to users physically present at the devices.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. [Assignement: security attributes] are associated with information exchanged between systems;
2. [Assignement: security attributes] are associated with information exchanged between system components;
3. [Assignement: privacy attributes] are associated with information exchanged between systems;
4. [Assignement: privacy attributes] are associated with information exchanged between system components.

Assessment Method

Examine

Interview

Control

1. Issue public key certificates under an [Assignement: certificate policy] or obtain public key certificates from an approved service provider; and
2. Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Discussion

Assessment Objective

1. public key certificates are issued under [Assignement: certificate policy] , or public key certificates are obtained from an approved service provider;
2. only approved trust anchors are included in trust stores or certificate stores managed by the organization.

Assessment Method

Examine

Interview

Control

1. Define acceptable and unacceptable mobile code and mobile code technologies; and
2. Authorize, monitor, and control the use of mobile code within the system.

Discussion

Assessment Objective

1. 1. acceptable mobile code is defined;
   2. unacceptable mobile code is defined;
   3. acceptable mobile code technologies are defined;
   4. unacceptable mobile code technologies are defined;
2. 1. the use of mobile code is authorized within the system;
   2. the use of mobile code is monitored within the system;
   3. the use of mobile code is controlled within the system.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and
2. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.

Discussion

Assessment Objective

1. 1. additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries;
   2. integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries;
2. 1. the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace;
   2. the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources;
2. data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources;
3. data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources;
4. data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. the systems that collectively provide name/address resolution services for an organization are fault-tolerant;
2. the systems that collectively provide name/address resolution services for an organization implement internal role separation;
3. the systems that collectively provide name/address resolution services for an organization implement external role separation.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. minimal functionality for [Assignement: system components] is employed;
2. minimal information storage on [Assignement: system components] is allocated.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks;
2. components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks;
3. components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection(one-or-more): storage; timing] channels; and
2. Estimate the maximum bandwidth of those channels.

Discussion

Assessment Objective

1. a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert [Selection(one-or-more): storage; timing] channels;
2. the maximum bandwidth of those channels is estimated.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. The operating environment from hardware-enforced, read-only media; and
2. The following applications from hardware-enforced, read-only media: [Assignement: applications].

Discussion

Assessment Objective

1. the operating environment for [Assignement: system components] is loaded and executed from hardware-enforced, read-only media;
2. [Assignement: applications] for [Assignement: system components] are loaded and executed from hardware-enforced, read-only media.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. [Assignement: processing components] are distributed across [Selection: physical locations; logical domains];
2. [Assignement: storage components] are distributed across [Selection: physical locations; logical domains].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. external [Assignement: wireless links] are protected from [Assignement: types of signal parameter attacks or references to sources for such attacks].
2. internal [Assignement: wireless links] are protected from [Assignement: types of signal parameter attacks or references to sources for such attacks].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Prohibit [Selection(one-or-more): the use of devices possessing {{ insert: param, sc-42_odp.02 }} in {{ insert: param, sc-42_odp.03 }} ; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: {{ insert: param, sc-42_odp.04 }} ] ; and
2. Provide an explicit indication of sensor use to [Assignement: group of users].

Discussion

Assessment Objective

1. [Selection(one-or-more): the use of devices possessing {{ insert: param, sc-42_odp.02 }} in {{ insert: param, sc-42_odp.03 }} ; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: {{ insert: param, sc-42_odp.04 }} ] is/are prohibited;
2. an explicit indication of sensor use is provided to [Assignement: group of users].

Assessment Method

Examine

Interview

Control

1. Establish usage restrictions and implementation guidelines for the following system components: [Assignement: components] ; and
2. Authorize, monitor, and control the use of such components within the system.

Discussion

Assessment Objective

1. usage restrictions and implementation guidelines are established for [Assignement: components];
2. 1. the use of [Assignement: components] is authorized within the system;
   2. the use of [Assignement: components] is monitored within the system;
   3. the use of [Assignement: components] is controlled within the system.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Employ hardware-based, write-protect for [Assignement: system firmware components] ; and
2. Implement specific procedures for [Assignement: authorized individuals] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.

Discussion

Assessment Objective

1. hardware-based write-protect for [Assignement: system firmware components] is employed;
2. 1. specific procedures are implemented for [Assignement: authorized individuals] to manually disable hardware write-protect for firmware modifications;
   2. specific procedures are implemented for [Assignement: authorized individuals] to re-enable the write-protect prior to returning to operational mode.

Assessment Method

Examine

Interview