+SC-07 Boundary Protection
---+SC-07(03) Access Points
---+SC-07(04) External Telecommunications Services
---+SC-07(05) Deny by Default — Allow by Exception
---+SC-07(07) Split Tunneling for Remote Devices
---+SC-07(08) Route Traffic to Authenticated Proxy Servers
---+SC-07(09) Restrict Threatening Outgoing Communications Traffic
---+SC-07(10) Prevent Exfiltration
---+SC-07(11) Restrict Incoming Communications Traffic
---+SC-07(12) Host-based Protection
---+SC-07(13) Isolation of Security Tools, Mechanisms, and Support Components
---+SC-07(14) Protect Against Unauthorized Physical Connections
---+SC-07(15) Networked Privileged Accesses
---+SC-07(16) Prevent Discovery of System Components
---+SC-07(17) Automated Enforcement of Protocol Formats
---+SC-07(18) Fail Secure
---+SC-07(19) Block Communication from Non-organizationally Configured Hosts
---+SC-07(20) Dynamic Isolation and Segregation
---+SC-07(21) Isolation of System Components
---+SC-07(22) Separate Subnets for Connecting to Different Security Domains
---+SC-07(23) Disable Sender Feedback on Protocol Validation Failure
---+SC-07(24) Personally Identifiable Information
---+SC-07(25) Unclassified National Security System Connections
---+SC-07(26) Classified National Security System Connections
---+SC-07(27) Unclassified Non-national Security System Connections
---+SC-07(28) Connections to Public Networks
---+SC-07(29) Separate Subnets to Isolate Functions

SC-07 Boundary Protection

Control

  1. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
  2. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
  3. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Discussion

Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).

Assessment Objective

    1. communications at external managed interfaces to the system are monitored;
    2. communications at external managed interfaces to the system are controlled;
    3. communications at key internal managed interfaces within the system are monitored;
    4. communications at key internal managed interfaces within the system are controlled;
  2. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks;
  3. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection list of key internal boundaries of the system system design documentation boundary protection hardware and software system configuration settings and associated documentation enterprise security architecture documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities

1. Panoramica

SC-07(03) Access Points

Control

Limit the number of external network connections to the system.

Discussion

Limiting the number of external network connections facilitates monitoring of inbound and outbound communications traffic. The Trusted Internet Connection [DHS TIC](#4f42ee6e-86cc-403b-a51f-76c2b4f81b54) initiative is an example of a federal guideline that requires limits on the number of external network connections. Limiting the number of external network connections to the system is important during transition periods from older to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols). Such transitions may require implementing the older and newer technologies simultaneously during the transition period and thus increase the number of access points to the system.

Assessment Objective

the number of external network connections to the system is limited.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation boundary protection hardware and software system architecture and configuration documentation system configuration settings and associated documentation communications and network traffic monitoring logs system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(04) External Telecommunications Services

Control

  1. Implement a managed interface for each external telecommunication service;
  2. Establish a traffic flow policy for each managed interface;
  3. Protect the confidentiality and integrity of the information being transmitted across each interface;
  4. Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
  5. Review exceptions to the traffic flow policy [Assignement: frequency] and remove exceptions that are no longer supported by an explicit mission or business need;
  6. Prevent unauthorized exchange of control plane traffic with external networks;
  7. Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
  8. Filter unauthorized control plane traffic from external networks.

Discussion

External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic include Border Gateway Protocol (BGP) routing, Domain Name System (DNS), and management protocols. See [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.

Assessment Objective

  1. a managed interface is implemented for each external telecommunication service;
  2. a traffic flow policy is established for each managed interface;
    1. the confidentiality of the information being transmitted across each interface is protected;
    2. the integrity of the information being transmitted across each interface is protected;
  4. each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need;
    1. exceptions to the traffic flow policy are reviewed [Assignement: frequency];
    2. exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed;
  6. unauthorized exchanges of control plan traffic with external networks are prevented;
  7. information is published to enable remote networks to detect unauthorized control plane traffic from internal networks;
  8. unauthorized control plane traffic is filtered from external networks.

Assessment Method

Examine

System and communications protection policy traffic flow policy information flow control policy procedures addressing boundary protection system security architecture system design documentation boundary protection hardware and software system architecture and configuration documentation system configuration settings and associated documentation records of traffic flow policy exceptions system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(05) Deny by Default — Allow by Exception

Control

Deny network communications traffic by default and allow network communications traffic by exception [Selection(one-or-more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ].

Discussion

Denying by default and allowing by exception applies to inbound and outbound network communications traffic. A deny-all, permit-by-exception network communications traffic policy ensures that only those system connections that are essential and approved are allowed. Deny by default, allow by exception also applies to a system that is connected to an external system.

Assessment Objective

  1. network communications traffic is denied by default [Selection(one-or-more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ];
  2. network communications traffic is allowed by exception [Selection(one-or-more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(07) Split Tunneling for Remote Devices

Control

Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignement: safeguards].

Discussion

Split tunneling is the process of allowing a remote user or device to establish a non-remote connection with a system and simultaneously communicate via some other connection to a resource in an external network. This method of network access enables a user to access remote devices and simultaneously, access uncontrolled networks. Split tunneling might be desirable by remote users to communicate with local system resources, such as printers or file servers. However, split tunneling can facilitate unauthorized external connections, making the system vulnerable to attack and to exfiltration of organizational information. Split tunneling can be prevented by disabling configuration settings that allow such capability in remote devices and by preventing those configuration settings from being configurable by users. Prevention can also be achieved by the detection of split tunneling (or of configuration settings that allow split tunneling) in the remote device, and by prohibiting the connection if the remote device is using split tunneling. A virtual private network (VPN) can be used to securely provision a split tunnel. A securely provisioned VPN includes locking connectivity to exclusive, managed, and named environments, or to a specific set of pre-approved addresses, without user control.

Assessment Objective

split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignement: safeguards].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(08) Route Traffic to Authenticated Proxy Servers

Control

Route [Assignement: internal communications traffic] to [Assignement: external networks] through authenticated proxy servers at managed interfaces.

Discussion

External networks are networks outside of organizational control. A proxy server is a server (i.e., system or application) that acts as an intermediary for clients requesting system resources from non-organizational or other organizational servers. System resources that may be requested include files, connections, web pages, or services. Client requests established through a connection to a proxy server are assessed to manage complexity and provide additional protection by limiting direct connectivity. Web content filtering devices are one of the most common proxy servers that provide access to the Internet. Proxy servers can support the logging of Transmission Control Protocol sessions and the blocking of specific Uniform Resource Locators, Internet Protocol addresses, and domain names. Web proxies can be configured with organization-defined lists of authorized and unauthorized websites. Note that proxy servers may inhibit the use of virtual private networks (VPNs) and create the potential for "man-in-the-middle" attacks (depending on the implementation).

Assessment Objective

[Assignement: internal communications traffic] is routed to [Assignement: external networks] through authenticated proxy servers at managed interfaces.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(09) Restrict Threatening Outgoing Communications Traffic

Control

  1. Detect and deny outgoing communications traffic posing a threat to external systems; and
  2. Audit the identity of internal users associated with denied communications.

Discussion

Detecting outgoing communications traffic from internal actions that may pose threats to external systems is known as extrusion detection. Extrusion detection is carried out within the system at managed interfaces. Extrusion detection includes the analysis of incoming and outgoing communications traffic while searching for indications of internal threats to the security of external systems. Internal threats to external systems include traffic indicative of denial-of-service attacks, traffic with spoofed source addresses, and traffic that contains malicious code. Organizations have criteria to determine, update, and manage identified threats related to extrusion detection.

Assessment Objective

    1. outgoing communications traffic posing a threat to external systems is detected;
    2. outgoing communications traffic posing a threat to external systems is denied;
  2. the identity of internal users associated with denied communications is audited.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(10) Prevent Exfiltration

Control

  1. Prevent the exfiltration of information; and
  2. Conduct exfiltration tests [Assignement: frequency].

Discussion

Prevention of exfiltration applies to both the intentional and unintentional exfiltration of information. Techniques used to prevent the exfiltration of information from systems may be implemented at internal endpoints, external boundaries, and across managed interfaces and include adherence to protocol formats, monitoring for beaconing activity from systems, disconnecting external network interfaces except when explicitly needed, employing traffic profile analysis to detect deviations from the volume and types of traffic expected, call backs to command and control centers, conducting penetration testing, monitoring for steganography, disassembling and reassembling packet headers, and using data loss and data leakage prevention tools. Devices that enforce strict adherence to protocol formats include deep packet inspection firewalls and Extensible Markup Language (XML) gateways. The devices verify adherence to protocol formats and specifications at the application layer and identify vulnerabilities that cannot be detected by devices that operate at the network or transport layers. The prevention of exfiltration is similar to data loss prevention or data leakage prevention and is closely associated with cross-domain solutions and system guards that enforce information flow requirements.

Assessment Objective

  1. the exfiltration of information is prevented;
  2. exfiltration tests are conducted [Assignement: frequency].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(11) Restrict Incoming Communications Traffic

Control

Only allow incoming communications from [Assignement: authorized sources] to be routed to [Assignement: authorized destinations].

Discussion

General source address validation techniques are applied to restrict the use of illegal and unallocated source addresses as well as source addresses that should only be used within the system. The restriction of incoming communications traffic provides determinations that source and destination address pairs represent authorized or allowed communications. Determinations can be based on several factors, including the presence of such address pairs in the lists of authorized or allowed communications, the absence of such address pairs in lists of unauthorized or disallowed pairs, or meeting more general rules for authorized or allowed source and destination pairs. Strong authentication of network addresses is not possible without the use of explicit security protocols, and thus, addresses can often be spoofed. Further, identity-based incoming traffic restriction methods can be employed, including router access control lists and firewall rules.

Assessment Objective

only incoming communications from [Assignement: authorized sources] are allowed to be routed to [Assignement: authorized destinations].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(12) Host-based Protection

Control

Implement [Assignement: host-based boundary protection mechanisms] at [Assignement: system components].

Discussion

Host-based boundary protection mechanisms include host-based firewalls. System components that employ host-based boundary protection mechanisms include servers, workstations, notebook computers, and mobile devices.

Assessment Objective

[Assignement: host-based boundary protection mechanisms] are implemented at [Assignement: system components].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation boundary protection hardware and software system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities system users
SC-07(13) Isolation of Security Tools, Mechanisms, and Support Components

Control

Isolate [Assignement: information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

Discussion

Physically separate subnetworks with managed interfaces are useful in isolating computer network defenses from critical operational processing networks to prevent adversaries from discovering the analysis and forensics techniques employed by organizations.

Assessment Objective

[Assignement: information security tools, mechanisms, and support components] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation list of security tools and support components to be isolated from other internal system components system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(14) Protect Against Unauthorized Physical Connections

Control

Protect against unauthorized physical connections at [Assignement: managed interfaces].

Discussion

Systems that operate at different security categories or classification levels may share common physical and environmental controls, since the systems may share space within the same facilities. In practice, it is possible that these separate systems may share common equipment rooms, wiring closets, and cable distribution paths. Protection against unauthorized physical connections can be achieved by using clearly identified and physically separated cable trays, connection frames, and patch panels for each side of managed interfaces with physical access controls that enforce limited authorized access to these items.

Assessment Objective

[Assignement: managed interfaces] are protected against unauthorized physical connections.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation facility communications and wiring diagram system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(15) Networked Privileged Accesses

Control

Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.

Discussion

Privileged access provides greater accessibility to system functions, including security functions. Adversaries attempt to gain privileged access to systems through remote access to cause adverse mission or business impacts, such as by exfiltrating information or bringing down a critical system capability. Routing networked, privileged access requests through a dedicated, managed interface further restricts privileged access for increased access control and auditing.

Assessment Objective

  1. networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control;
  2. networked, privileged accesses are routed through a dedicated, managed interface for purposes of auditing.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation audit logs system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(16) Prevent Discovery of System Components

Control

Prevent the discovery of specific system components that represent a managed interface.

Discussion

Preventing the discovery of system components representing a managed interface helps protect network addresses of those components from discovery through common tools and techniques used to identify devices on networks. Network addresses are not available for discovery and require prior knowledge for access. Preventing the discovery of components and devices can be accomplished by not publishing network addresses, using network address translation, or not entering the addresses in domain name systems. Another prevention technique is to periodically change network addresses.

Assessment Objective

the discovery of specific system components that represent a managed interface is prevented.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(17) Automated Enforcement of Protocol Formats

Control

Enforce adherence to protocol formats.

Discussion

System components that enforce protocol formats include deep packet inspection firewalls and XML gateways. The components verify adherence to protocol formats and specifications at the application layer and identify vulnerabilities that cannot be detected by devices operating at the network or transport layers.

Assessment Objective

adherence to protocol formats is enforced.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(18) Fail Secure

Control

Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.

Discussion

Fail secure is a condition achieved by employing mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces, systems do not enter into unsecure states where intended security properties no longer hold. Managed interfaces include routers, firewalls, and application gateways that reside on protected subnetworks (commonly referred to as demilitarized zones). Failures of boundary protection devices cannot lead to or cause information external to the devices to enter the devices nor can failures permit unauthorized information releases.

Assessment Objective

systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(19) Block Communication from Non-organizationally Configured Hosts

Control

Block inbound and outbound communications traffic between [Assignement: communication clients] that are independently configured by end users and external service providers.

Discussion

Communication clients independently configured by end users and external service providers include instant messaging clients and video conferencing software and applications. Traffic blocking does not apply to communication clients that are configured by organizations to perform authorized functions.

Assessment Objective

  1. inbound communications traffic is blocked between [Assignement: communication clients] that are independently configured by end users and external service providers;
  2. outbound communications traffic is blocked between [Assignement: communication clients] that are independently configured by end users and external service providers.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation list of communication clients independently configured by end users and external service providers system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(20) Dynamic Isolation and Segregation

Control

Provide the capability to dynamically isolate [Assignement: system components] from other system components.

Discussion

The capability to dynamically isolate certain internal system components is useful when it is necessary to partition or separate system components of questionable origin from components that possess greater trustworthiness. Component isolation reduces the attack surface of organizational systems. Isolating selected system components can also limit the damage from successful attacks when such attacks occur.

Assessment Objective

the capability to dynamically isolate [Assignement: system components] from other system components is provided.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation list of system components to be dynamically isolated/segregated from other components of the system system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(21) Isolation of System Components

Control

Employ boundary protection mechanisms to isolate [Assignement: system components] supporting [Assignement: missions and/or business functions].

Discussion

Organizations can isolate system components that perform different mission or business functions. Such isolation limits unauthorized information flows among system components and provides the opportunity to deploy greater levels of protection for selected system components. Isolating system components with boundary protection mechanisms provides the capability for increased protection of individual system components and to more effectively control information flows between those components. Isolating system components provides enhanced protection that limits the potential harm from hostile cyber-attacks and errors. The degree of isolation varies depending upon the mechanisms chosen. Boundary protection mechanisms include routers, gateways, and firewalls that separate system components into physically separate networks or subnetworks; cross-domain devices that separate subnetworks; virtualization techniques; and the encryption of information flows among system components using distinct encryption keys.

Assessment Objective

boundary protection mechanisms are employed to isolate [Assignement: system components] supporting [Assignement: missions and/or business functions].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software enterprise architecture documentation system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities
SC-07(22) Separate Subnets for Connecting to Different Security Domains

Control

Implement separate network addresses to connect to systems in different security domains.

Discussion

The decomposition of systems into subnetworks (i.e., subnets) helps to provide the appropriate level of protection for network connections to different security domains that contain information with different security categories or classification levels.

Assessment Objective

separate network addresses are implemented to connect to systems in different security domains.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(23) Disable Sender Feedback on Protocol Validation Failure

Control

Disable feedback to senders on protocol format validation failure.

Discussion

Disabling feedback to senders when there is a failure in protocol validation format prevents adversaries from obtaining information that would otherwise be unavailable.

Assessment Objective

feedback to senders is disabled on protocol format validation failure.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(24) Personally Identifiable Information

Control

For systems that process personally identifiable information:
  1. Apply the following processing rules to data elements of personally identifiable information: [Assignement: processing rules];
  2. Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;
  3. Document each processing exception; and
  4. Review and remove exceptions that are no longer supported.

Discussion

Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.

Assessment Objective

  1. [Assignement: processing rules] are applied to data elements of personally identifiable information on systems that process personally identifiable information;
    1. permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;
    2. permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;
  3. each processing exception is documented for systems that process personally identifiable information;
    1. exceptions for systems that process personally identifiable information are reviewed;
    2. exceptions for systems that process personally identifiable information that are no longer supported are removed.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection personally identifiable information processing policies list of key internal boundaries of the system system design documentation system configuration settings and associated documentation enterprise security and privacy architecture documentation system audit records system security plan privacy plan personally identifiable information inventory documentation data mapping documentation other relevant documents or records

Interview

System/network administrators organizational personnel with information security and privacy responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(25) Unclassified National Security System Connections

Control

Prohibit the direct connection of [Assignement: unclassified national security system] to an external network without the use of [Assignement: boundary protection device].

Discussion

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified national security systems and external networks.

Assessment Objective

the direct connection of [Assignement: unclassified national security system] to an external network without the use of [Assignement: boundary protection device] is prohibited.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(26) Classified National Security System Connections

Control

Prohibit the direct connection of a classified national security system to an external network without the use of [Assignement: boundary protection device].

Discussion

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between classified national security systems and external networks. In addition, approved boundary protection devices (typically managed interface or cross-domain systems) provide information flow enforcement from systems to external networks.

Assessment Objective

the direct connection of classified national security system to an external network without the use of a [Assignement: boundary protection device] is prohibited.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(27) Unclassified Non-national Security System Connections

Control

Prohibit the direct connection of [Assignement: unclassified, non-national security system] to an external network without the use of [Assignement: boundary protection device].

Discussion

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified non-national security systems and external networks.

Assessment Objective

the direct connection of [Assignement: unclassified, non-national security system] to an external network without the use of a [Assignement: boundary protection device] is prohibited.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(28) Connections to Public Networks

Control

Prohibit the direct connection of [Assignement: system] to a public network.

Discussion

A direct connection is a dedicated physical or virtual connection between two or more systems. A public network is a network accessible to the public, including the Internet and organizational extranets with public access.

Assessment Objective

the direct connection of the [Assignement: system] to a public network is prohibited.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities
SC-07(29) Separate Subnets to Isolate Functions

Control

Implement [Selection: physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignement: critical system components and functions].

Discussion

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.

Assessment Objective

subnetworks are separated [Selection: physically; logically] to isolate [Assignement: critical system components and functions].

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation criticality analysis system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by SC-07 Boundary Protection – Assessment Procedure
is blocked by Boundary Protection