Assessment Objective

Determine if:

• SC-03(02)[01] security functions enforcing access control are isolated from non-security functions;
• SC-03(02)[02] security functions enforcing access control are isolated from other security functions;
• SC-03(02)[03] security functions enforcing information flow control are isolated from non-security functions;
• SC-03(02)[04] security functions enforcing information flow control are isolated from other security functions.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing security function isolation
• list of critical security functions
• system design documentation
• system configuration settings and associated documentation
• system audit records system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developer

Test

• Isolation of security functions enforcing access and information flow control

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final