03.13.01E Heterogeneity

Statement

Employ a diverse set of information technologies for the following system components in the implementation of the system: {{ insert: param, A.03.13.01E.ODP.01 }}.

Guidance

Increasing the diversity of information technologies within organizational systems reduces the impact of exploitations or compromises of specific technologies. Such diversity protects against common mode failures, including those failures induced by supply chain attacks. Diversity in information technologies also reduces the likelihood that the means adversaries use to compromise one system component will be effective against other system components, thus further increasing the adversary work factor to successfully complete planned attacks. An increase in diversity may add complexity and management overhead that could ultimately lead to mistakes and unauthorized configurations. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes contain and exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

Assessment objective

a diverse set of information technologies is employed for {{ insert: param, A.03.13.01E.ODP.01 }} in the implementation of the system.

Assessment method

• System and communications protection policy system design documentation system configuration settings and associated documentation list of technologies deployed in the system acquisition documentation acquisition contracts for system components or services system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities personnel with system acquisition, development, and implementation responsibilities

Assessment method

• Mechanisms supporting and/or implementing the use of a diverse set of information technologies

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final