System and Communications Protection
NIST SP 800-53 Rev 5 System and Communications Protection controls.
Policy and Procedures
Develop, document, and disseminate to [parameter]:
Separation of System and User Functionality
Separate user functionality, including user interface services, from system management functionality.
Security Function Isolation
Isolate security functions from nonsecurity functions.
Information in Shared System Resources
Prevent unauthorized and unintended information transfer via shared system resources.
Denial-of-service Protection
[parameter] the effects of the following types of denial-of-service events: [parameter] ; and
Resource Availability
Protect the availability of resources by allocating [parameter] by [parameter].
Boundary Protection
Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
Transmission Confidentiality and Integrity
Protect the [parameter] of transmitted information.
Transmission Confidentiality
Transmission Confidentiality
Network Disconnect
Terminate the network connection associated with a communications session at the end of the session or after [parameter] of inactivity.
Trusted Path
Provide a [parameter] isolated trusted communications path for communications between the user and the trusted components of the system; and
Cryptographic Key Establishment and Management
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [parameter].
Cryptographic Protection
Determine the [parameter] ; and
Public Access Protections
Public Access Protections
Collaborative Computing Devices and Applications
Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [parameter] ; and
Transmission of Security and Privacy Attributes
Associate [parameter] with information exchanged between systems and between system components.
Public Key Infrastructure Certificates
Issue public key certificates under an [parameter] or obtain public key certificates from an approved service provider; and
Mobile Code
Define acceptable and unacceptable mobile code and mobile code technologies; and
Voice Over Internet Protocol
Technology-specific; addressed as any other technology or protocol.
Secure Name/Address Resolution Service (Authoritative Source)
Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and
Secure Name/Address Resolution Service (Recursive or Caching Resolver)
Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
Architecture and Provisioning for Name/Address Resolution Service
Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.
Session Authenticity
Protect the authenticity of communications sessions.
Fail in Known State
Fail to a [parameter] for the following failures on the indicated components while preserving [parameter] in failure: [parameter].
Thin Nodes
Employ minimal functionality and information storage on the following system components: [parameter].
Decoys
Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.
Platform-independent Applications
Include within organizational systems the following platform independent applications: [parameter].
Protection of Information at Rest
Protect the [parameter] of the following information at rest: [parameter].
Heterogeneity
Employ a diverse set of information technologies for the following system components in the implementation of the system: [parameter].
Concealment and Misdirection
Employ the following concealment and misdirection techniques for [parameter] at [parameter] to confuse and mislead adversaries: [parameter].
Covert Channel Analysis
Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [parameter] channels; and
System Partitioning
Partition the system into [parameter] residing in separate [parameter] domains or environments based on [parameter].
Transmission Preparation Integrity
Transmission Preparation Integrity
Non-modifiable Executable Programs
For [parameter] , load and execute:
External Malicious Code Identification
Include system components that proactively seek to identify network-based malicious code or malicious websites.
Distributed Processing and Storage
Distribute the following processing and storage components across multiple [parameter]: [parameter].
Out-of-band Channels
Employ the following out-of-band channels for the physical delivery or electronic transmission of [parameter] to [parameter]: [parameter].
Operations Security
Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [parameter].
Process Isolation
Maintain a separate execution domain for each executing system process.
Wireless Link Protection
Protect external and internal [parameter] from the following signal parameter attacks: [parameter].
Port and I/O Device Access
[parameter] disable or remove [parameter] on the following systems or system components: [parameter].
Sensor Capability and Data
Prohibit [parameter] ; and
Usage Restrictions
Establish usage restrictions and implementation guidelines for the following system components: [parameter] ; and
Detonation Chambers
Employ a detonation chamber capability within [parameter].
System Time Synchronization
Synchronize system clocks within and between systems and system components.
Cross Domain Policy Enforcement
Implement a policy enforcement mechanism [parameter] between the physical and/or network interfaces for the connecting security domains.
Alternate Communications Paths
Establish [parameter] for system operations organizational command and control.
Sensor Relocation
Relocate [parameter] to [parameter] under the following conditions or circumstances: [parameter].
Hardware-enforced Separation and Policy Enforcement
Implement hardware-enforced separation and policy enforcement mechanisms between [parameter].
Software-enforced Separation and Policy Enforcement
Implement software-enforced separation and policy enforcement mechanisms between [parameter].
Hardware-based Protection
Employ hardware-based, write-protect for [parameter] ; and