03.13 System and Communications Protection

Statement

• a. Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system.

• b. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

• c. Connect to external systems only through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Guidance

Managed interfaces include gateways, routers, firewalls, network-based malicious code analysis, virtualization systems, and encrypted tunnels implemented within a security architecture. Subnetworks that are either physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses.

Assessment objective

communications at external managed interfaces to the system are monitored.

Assessment objective

communications at external managed interfaces to the system are controlled.

Assessment objective

communications at key internal managed interfaces within the system are monitored.

Assessment objective

communications at key internal managed interfaces within the system are controlled.

Assessment objective

subnetworks are implemented for publicly accessible system components that are physically or logically separated from internal networks.

Assessment objective

external system connections are only made through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Assessment method

• system and communications protection policy and procedures procedures for boundary protection list of key internal boundaries within the system boundary protection hardware and software system configuration settings security architecture system audit records system design documentation system security plan other relevant documents or records

Assessment method

• personnel with boundary protection responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for implementing boundary protection capabilities

Statement

Prevent unauthorized and unintended information transfer via shared system resources.

Guidance

Preventing unauthorized and unintended information transfer via shared system resources stops information produced by the actions of prior users or roles (or actions of processes acting on behalf of prior users or roles) from being available to current users or roles (or current processes acting on behalf of current users or roles) that obtain access to shared system resources after those resources have been released back to the system. Information in shared system resources also applies to encrypted representations of information. In other contexts, the control of information in shared system resources is referred to as object reuse and residual information protection. Information in shared system resources does not address information remanence, which refers to the residual representation of data that has been nominally deleted, covert channels (including storage and timing channels) in which shared system resources are manipulated to violate information flow restrictions, or components within systems for which there are only single users or roles.

Assessment objective

unauthorized information transfer via shared system resources is prevented.

Assessment objective

unintended information transfer via shared system resources is prevented.

Assessment method

• system and communications protection policy and procedures procedures for information protection in shared system resources system configuration settings system audit records system design documentation system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for preventing the unauthorized and unintended transfer of information via shared system resources

Statement

Deny network communications traffic by default, and allow network communications traffic by exception.

Guidance

This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, allow-by-exception network communications traffic policy ensures that only essential and approved connections are allowed.

Assessment objective

network communications traffic is denied by default.

Assessment objective

network communications traffic is allowed by exception.

Assessment method

• system and communications protection policy and procedures procedures for boundary protection system design documentation system configuration settings system audit records system security plan other relevant documents or records

Assessment method

• personnel with boundary protection responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for implementing traffic management at managed interfaces

Statement

Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI during transmission and while in storage.

Guidance

This requirement applies to internal and external networks and any system components that can transmit CUI, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are susceptible to interception and modification. Encryption protects CUI from unauthorized disclosure during transmission and while in storage. Cryptographic mechanisms that protect the confidentiality of CUI during transmission include TLS and IPsec. Information in storage (i.e., information at rest) refers to the state of CUI when it is not in process or in transit and resides on internal or external storage devices, storage area network devices, and databases. Protecting CUI in storage does not focus on the type of storage device or the frequency of access to that device but rather on the state of the information. This requirement relates to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.11) 03.13.11.

Assessment objective

cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI during transmission.

Assessment objective

cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI while in storage.

Assessment method

• system and communications protection policy and procedures procedures for transmission confidentiality procedures for the protection of information at rest system design documentation system configuration settings cryptographic mechanisms and associated configuration documentation information in storage requiring confidentiality protection system audit records system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing transmission confidentiality cryptographic mechanisms for supporting or implementing transmission confidentiality mechanisms for supporting or implementing confidentiality protection for information in storage cryptographic mechanisms for implementing confidentiality protections for information in storage

Statement

Terminate the network connection associated with a communications session at the end of the session or after {{ insert: param, A.03.13.09.ODP.01 }} of inactivity.

Guidance

This requirement applies to internal and external networks. Terminating network connections associated with communications sessions includes deallocating TCP/IP addresses or port pairs at the operating system level or deallocating networking assignments at the application level if multiple application sessions are using a single network connection. Time periods of inactivity may be established by organizations and include time periods by type of network access or for specific network accesses.

Assessment objective

the network connection associated with a communications session is terminated at the end of the session or after {{ insert: param, A.03.13.09.ODP.01 }} of inactivity.

Assessment method

• system and communications protection policy and procedures procedures for network disconnect system design documentation system configuration settings system audit records system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing a network disconnect capability

Statement

Establish and manage cryptographic keys in the system in accordance with the following key management requirements: {{ insert: param, A.03.13.10.ODP.01 }}.

Guidance

Cryptographic keys can be established and managed using either manual procedures or automated mechanisms supported by manual procedures. Organizations satisfy key establishment and management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards that specify appropriate options, levels, and parameters. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.11) 03.13.11.

Assessment objective

cryptographic keys are established in the system in accordance with the following key management requirements: {{ insert: param, A.03.13.10.ODP.01 }}.

Assessment objective

cryptographic keys are managed in the system in accordance with the following key management requirements: {{ insert: param, A.03.13.10.ODP.01 }}.

Assessment method

• system and communications protection policy and procedures procedures for cryptographic key establishment and management system design documentation system configuration settings cryptographic mechanisms system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for cryptographic key establishment or management personnel with information security responsibilities system administrators

Assessment method

• mechanisms for supporting or implementing cryptographic key establishment and management

Statement

Implement the following types of cryptography to protect the confidentiality of CUI: {{ insert: param, A.03.13.11.ODP.01 }}.

Guidance

Cryptography is implemented in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. FIPS-validated cryptography is recommended for the protection of CUI.

Assessment objective

the following types of cryptography are implemented to protect the confidentiality of CUI: {{ insert: param, A.03.13.11.ODP.01 }}.

Assessment method

• system and communications protection policy and procedures procedures for cryptographic protection system design documentation system configuration settings cryptographic module validation certificates list of FIPS-validated cryptographic modules system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for cryptographic protection personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing cryptographic protection

Statement

• a. Prohibit the remote activation of collaborative computing devices and applications with the following exceptions: {{ insert: param, A.03.13.12.ODP.01 }}.

• b. Provide an explicit indication of use to users physically present at the devices.

Guidance

Collaborative computing devices include white boards, microphones, and cameras. Notebook computers, smartphones, display monitors, and tablets containing cameras and microphones are considered part of collaborative computing devices when conferencing software is in use. Indication of use includes notifying users (e.g., a pop-up menu stating that recording is in progress or that the microphone has been turned on) when collaborative computing devices are activated. Dedicated video conferencing systems, which typically rely on one of the participants calling or connecting to the other party to activate the video conference, are excluded. Solutions to prevent device usage include webcam covers and buttons to disable microphones.

Assessment objective

the remote activation of collaborative computing devices and applications is prohibited with the following exceptions: {{ insert: param, A.03.13.12.ODP.01 }}.

Assessment objective

an explicit indication of use is provided to users who are physically present at the devices.

Assessment method

• system and communications protection policy and procedures procedures for collaborative computing access control policy and procedures system configuration settings system design documentation system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing collaborative computing devices personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for supporting or implementing the management of remote activation of collaborative computing devices mechanisms for providing an indication of use of collaborative computing devices

Statement

• a. Define acceptable mobile code and mobile code technologies.

• b. Authorize, monitor, and control the use of mobile code.

Guidance

Mobile code includes software programs or parts of programs that are obtained from remote systems, transmitted across a network, and executed on a local system without explicit installation or execution by the recipient. Decisions regarding the use of mobile code are based on the potential for the code to cause damage to the system if used maliciously. Mobile code technologies include Java applets, JavaScript, HTML5, VBScript, and WebGL. Usage restrictions and implementation guidelines apply to the selection and use of mobile code installed on servers and downloaded and executed on individual workstations and devices, including notebook computers, smart phones, and smart devices. Mobile code policies and procedures address the actions taken to prevent the development, acquisition, and use of unacceptable mobile code within the system, including requiring mobile code to be digitally signed by a trusted source.

Assessment objective

the use of mobile code is authorized.

Assessment objective

the use of mobile code is monitored.

Assessment objective

the use of mobile code is controlled.

Assessment objective

acceptable mobile code is defined.

Assessment objective

acceptable mobile code technologies are defined.

Assessment method

• system and communications protection policy and procedures procedures for mobile code mobile code implementation policy and procedures list of acceptable mobile code and mobile code technologies authorization records system monitoring records system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing mobile code personnel with information security responsibilities system administrators

Assessment method

• processes for authorizing, monitoring, and controlling mobile code mechanisms for supporting or implementing the management of mobile code mechanisms for supporting or implementing mobile code monitoring

Statement

Protect the authenticity of communications sessions.

Guidance

Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of the communications sessions in the ongoing identities of other parties and the validity of the transmitted information. Authenticity protection includes protecting against adversary-in-the-middle attacks, session hijacking, and the insertion of false information into sessions.

Assessment objective

the authenticity of communications sessions is protected.

Assessment method

• system and communications protection policy and procedures procedures for session authenticity system design documentation system configuration settings system audit records system security plan other relevant documents or records

Assessment method

• personnel with information security responsibilities system administrators

Assessment method

• mechanisms for supporting or implementing session authenticity