SC-1 Policy and procedures
The system and communications protection policy and procedures: ownership, scope, review frequency and how this -1 control governs network, cryptography and isolation controls in the SC family.
SC System and communications protection
System and communications protection family: boundary protection, transmission and at-rest encryption, key and certificate management, DNS security, session authenticity, isolation and separation controls, and time synchronization.
SC-2 Separation of system and user functionality
Separating user functions from system management functions, for example administrative interfaces on separate hosts, networks or access paths, and how assessors test that users cannot reach management functionality.
SC-3 Security function isolation
Security function isolation: keeping access enforcement, auditing and other security functions in protected domains separate from nonsecurity code, for example through partitions and domains. High baseline only.
SC-4 Information in shared system resources
Information in shared system resources: object reuse and residual information protection so memory, storage and registers released by one user or process expose nothing to the next.
SC-5 Denial-of-service protection
Denial-of-service protection: identifying the denial-of-service events that matter, the protections chosen for each (capacity, filtering, rate limiting, upstream services) and the evidence an assessor expects.
SC-6 Resource availability
Resource availability: allocating processor, memory, bandwidth and storage by priority or quota so that lower-priority processes cannot starve critical ones. Not in any SP 800-53B baseline.
SC-7 Boundary protection
Boundary protection: managed interfaces, DMZs, deny-by-default traffic rules and internal segmentation. It has the most enhancements in the SC family and is a FedRAMP annual assessment control.
SC-8 Transmission confidentiality and integrity
Transmission confidentiality and integrity: encrypting and protecting data in transit across internal and external networks, with the cryptographic protection enhancement selected in the moderate and high baselines and at every FedRAMP Rev5 class.
SC-10 Network disconnect
Network disconnect: ending network sessions at session end or after an inactivity timeout, as distinct from the user-level session lock and termination controls in the AC family.
SC-11 Trusted path
Trusted path: an isolated, unspoofable channel between the user and trusted system components for authentication and other security functions. Not in any SP 800-53B baseline.
SC-12 Cryptographic key establishment and management
Cryptographic key establishment and management: generation, distribution, storage, access, rotation and destruction of keys, and the key availability enhancement selected in the high baseline and at FedRAMP Class D.
SC-13 Cryptographic protection
Cryptographic protection: deciding where cryptography is required and which type (for example FIPS-validated or NSA-approved) applies to each use. All of its enhancements are withdrawn.
SC-15 Collaborative computing devices and applications
Collaborative computing devices and applications: blocking remote activation of cameras, microphones and similar devices and showing users when they are active. In all three security baselines.
SC-16 Transmission of security and privacy attributes
Transmission of security and privacy attributes: binding labels and other attributes to information as it moves between systems and components, with integrity verification, anti-spoofing and cryptographic binding enhancements. Not in any baseline.
SC-17 Public key infrastructure certificates
Public key infrastructure certificates: certificate policy, approved certificate providers and control of trust anchors in certificate stores. In the moderate and high baselines.
SC-18 Mobile code
Mobile code: deciding which scripts, macros and similar downloadable code are allowed, and authorizing, monitoring and controlling their use. In the moderate and high baselines.
SC-20 Secure name/address resolution service (authoritative source)
Secure authoritative name and address resolution: signing authoritative DNS data (DNSSEC) and supporting chain-of-trust validation for external queries. In all three security baselines.
SC-21 Secure name/address resolution service (recursive or caching resolver)
Secure recursive and caching name resolution: validating DNSSEC signatures on responses from authoritative servers. The counterpart of SC-20 and a FedRAMP annual assessment control.
SC-22 Architecture and provisioning for name/address resolution service
Architecture and provisioning for name and address resolution: redundant DNS servers and separation of internal and external resolution roles. In all three security baselines.
SC-23 Session authenticity
Session authenticity: protecting sessions against hijacking, replay and man-in-the-middle attacks, with enhancements such as invalidating session identifiers at logout and unique session identifiers.
SC-24 Fail in known state
Fail in known state: designing components to fail to a predefined known state and preserve state information for recovery. Selected only in the high baseline.
SC-25 Thin nodes
Thin nodes: limiting functionality and local storage on components such as thin clients so they offer attackers less to exploit. Not in any SP 800-53B baseline.
SC-26 Decoys
Decoys: honeypots and similar components that attract attackers so their techniques can be detected, deflected and analyzed. Not in any SP 800-53B baseline.
SC-27 Platform-independent applications
Platform-independent applications: using applications that run across platforms so that critical functions survive when one platform is compromised. Not in any SP 800-53B baseline.
SC-28 Protection of information at rest
Protection of information at rest: encrypting or otherwise protecting stored data on servers, databases, storage and backups, with the cryptographic protection enhancement FedRAMP requires at every class.
SC-29 Heterogeneity
Heterogeneity: using diverse technologies so one exploited vulnerability does not compromise every component. Not in any SP 800-53B baseline.
SC-30 Concealment and misdirection
Concealment and misdirection: techniques such as randomness, changing processing locations and misleading information that make targeting harder for adversaries. Not in any SP 800-53B baseline.
SC-31 Covert channel analysis
Covert channel analysis: finding storage and timing channels that could leak information in violation of policy and estimating their bandwidth. Not in any SP 800-53B baseline.
SC-32 System partitioning
System partitioning: placing components in separate physical or logical domains, such as separate networks or enclaves, based on their security needs. Not in any SP 800-53B baseline.
SC-34 Non-modifiable executable programs
Non-modifiable executable programs: running operating systems and applications from read-only media so they cannot be altered at rest. Not in any SP 800-53B baseline.
SC-35 External malicious code identification
External malicious code identification: components that actively probe networks, including the internet, for malicious code and malicious websites. Not in any SP 800-53B baseline.
SC-36 Distributed processing and storage
Distributed processing and storage: spreading processing and storage across locations or domains to avoid single points of compromise or failure, with polling and synchronization enhancements. Not in any baseline.
SC-37 Out-of-band channels
Out-of-band channels: delivering keys, credentials, patches or components through channels separate from the normal network so a compromised channel cannot intercept them. Not in any baseline.
SC-38 Operations security
Operations security: identifying critical information and limiting what adversaries can learn about the system across its life cycle. Not in any SP 800-53B baseline.
SC-39 Process isolation
Process isolation: separate address spaces and execution domains for each process, typically provided by the operating system or virtualization. In all three security baselines.
SC-40 Wireless link protection
Wireless link protection: defending wireless links against jamming, spoofing and signal-based attacks, with enhancements for electromagnetic interference and reducing detection potential. Not in any baseline.
SC-41 Port and I/O device access
Port and I/O device access: disabling or removing USB ports, optical drives and other connection points that are not needed. Not in any SP 800-53B baseline.
SC-42 Sensor capability and data
Sensor capability and data: controlling cameras, microphones, GPS and other sensors in devices, including remote activation and indication of use. Not in any SP 800-53B baseline.
SC-43 Usage restrictions
Usage restrictions: rules for using components such as mobile code, mobile devices, wireless access and peripherals like printers and scanners, and monitoring their use. Not in any SP 800-53B baseline.
SC-44 Detonation chambers
Detonation chambers: isolated sandboxes that open suspicious attachments and links so malicious behavior can be observed safely. Not in any SP 800-53B baseline.
SC-45 System time synchronization
System time synchronization: keeping clocks aligned so audit records and events correlate, with the authoritative time source enhancement that FedRAMP selects at Classes C and D.
SC-46 Cross domain policy enforcement
Cross domain policy enforcement: guards and similar mechanisms that enforce policy between interfaces of connected security domains. Not in any SP 800-53B baseline.
SC-47 Alternate communications paths
Alternate communications paths: backup channels for operational command and control when primary communications are compromised or unavailable. Not in any SP 800-53B baseline.
SC-48 Sensor relocation
Sensor relocation: moving monitoring sensors in response to changing threats, so adversaries cannot simply avoid fixed monitoring points. Not in any SP 800-53B baseline.
SC-49 Hardware-enforced separation and policy enforcement
Hardware-enforced separation and policy enforcement between security domains, for higher assurance than software-only separation. Not in any SP 800-53B baseline.
SC-50 Software-enforced separation and policy enforcement
Software-enforced separation and policy enforcement between security domains, for domains that need more than baseline isolation. Not in any SP 800-53B baseline.
SC-51 Hardware-based protection
Hardware-based protection: write-protecting firmware in hardware and controlling the manual procedure to lift protection for authorized updates. Not in any SP 800-53B baseline.
