CyberStrikeus/CyberStrike - Page 140

sc-48-1-dynamic-relocation-of-sensors-or-monitoring-capabilities

Dynamically relocate [organization-defined] to [organization-defined] under the following conditions or circumstances: [organization-defined].

sc-48-sensor-relocation

Relocate [organization-defined] to [organization-defined] under the following conditions or circumstances: [organization-defined].

sc-49-hardware-enforced-separation-and-policy-enforcement

Implement hardware-enforced separation and policy enforcement mechanisms between [organization-defined].

sc-5-1-restrict-ability-to-attack-other-systems

Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [organization-defined].

sc-5-2-capacity-bandwidth-and-redundancy

Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.

sc-5-3-detection-and-monitoring

Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [organization-define...

sc-5-denial-of-service-protection

[organization-defined] the effects of the following types of denial-of-service events: [organization-defined] ;

sc-50-software-enforced-separation-and-policy-enforcement

Implement software-enforced separation and policy enforcement mechanisms between [organization-defined].

sc-51-hardware-based-protection

Employ hardware-based, write-protect for [organization-defined] ;

sc-6-resource-availability

Protect the availability of resources by allocating [organization-defined] by [organization-defined].

sc-7-1-physically-separated-subnetworks

Physically Separated Subnetworks

sc-7-10-prevent-exfiltration

Prevent the exfiltration of information;

sc-7-11-restrict-incoming-communications-traffic

Only allow incoming communications from [organization-defined] to be routed to [organization-defined].

sc-7-12-host-based-protection

Implement [organization-defined] at [organization-defined].

sc-7-14-protect-against-unauthorized-physical-connections

Protect against unauthorized physical connections at [organization-defined].

sc-7-15-networked-privileged-accesses

Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.

sc-7-16-prevent-discovery-of-system-components

Prevent the discovery of specific system components that represent a managed interface.

sc-7-17-automated-enforcement-of-protocol-formats

Enforce adherence to protocol formats.

sc-7-18-fail-secure

Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.

sc-7-2-public-access

Public Access

sc-7-20-dynamic-isolation-and-segregation

Provide the capability to dynamically isolate [organization-defined] from other system components.

sc-7-21-isolation-of-system-components

Employ boundary protection mechanisms to isolate [organization-defined] supporting [organization-defined].

sc-7-23-disable-sender-feedback-on-protocol-validation-failure

Disable feedback to senders on protocol format validation failure.

sc-7-24-personally-identifiable-information

For systems that process personally identifiable information: Apply the following processing rules to data elements of personally identifiable informa

sc-7-25-unclassified-national-security-system-connections

Prohibit the direct connection of [organization-defined] to an external network without the use of [organization-defined].

sc-7-26-classified-national-security-system-connections

Prohibit the direct connection of a classified national security system to an external network without the use of [organization-defined].

sc-7-27-unclassified-non-national-security-system-connections

Prohibit the direct connection of [organization-defined] to an external network without the use of [organization-defined].

sc-7-28-connections-to-public-networks

Prohibit the direct connection of [organization-defined] to a public network.

sc-7-29-separate-subnets-to-isolate-functions

Implement [organization-defined] separate subnetworks to isolate the following critical system components and functions: [organization-defined].

sc-7-3-access-points

Limit the number of external network connections to the system.

sc-7-4-external-telecommunications-services

Implement a managed interface for each external telecommunication service;

sc-7-5-deny-by-default-allow-by-exception

Deny network communications traffic by default and allow network communications traffic by exception [organization-defined].

sc-7-6-response-to-recognized-failures

Response to Recognized Failures

sc-7-7-split-tunneling-for-remote-devices

Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [organization-de

sc-7-8-route-traffic-to-authenticated-proxy-servers

Route [organization-defined] to [organization-defined] through authenticated proxy servers at managed interfaces.

sc-7-9-restrict-threatening-outgoing-communications-traffic

Detect and deny outgoing communications traffic posing a threat to external systems;

sc-7-boundary-protection

Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;

sc-8-1-cryptographic-protection

Implement cryptographic mechanisms to [organization-defined] during transmission.

sc-8-2-pre-and-post-transmission-handling

Maintain the [organization-defined] of information during preparation for transmission and during reception.

sc-8-3-cryptographic-protection-for-message-externals

Implement cryptographic mechanisms to protect message externals unless otherwise protected by [organization-defined].