03.13.16E System Partitioning

Statement

Partition the system into {{ insert: param, A.03.13.16E.ODP.02 }} residing in separate {{ insert: param, A.03.13.16E.ODP.01 }} domains or environments based on {{ insert: param, A.03.13.16E.ODP.03 }}.

Guidance

System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Managed interfaces restrict or prohibit network access and information flow among partitioned system components. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

Assessment objective

the system is partitioned into {{ insert: param, A.03.13.16E.ODP.01 }} residing in separate {{ insert: param, A.03.13.16E.ODP.02 }} security domains or environments based on {{ insert: param, A.03.13.16E.ODP.03 }}.

Assessment method

• System and communications protection policy procedures addressing system partitioning system design documentation system configuration settings and associated documentation system architecture list of system physical domains (or environments) system facility diagrams system network diagrams system security plan other relevant documents or records

Assessment method

• System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system system developers/integrators

Assessment method

• Mechanisms supporting and/or implementing the physical separation of system components

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final