SC-25

Requirement

Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].

Discussion

The deployment of system components with minimal functionality reduces the need to secure every endpoint and may reduce the exposure of information, systems, and services to attacks. Reduced or minimal functionality includes diskless nodes and thin client technologies.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing use of thin nodes; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities].

ID	Assessment Objectives
SC-25[01]	minimal functionality for <SC-25_ODP system components> is employed;
SC-25[02]	minimal information storage on <SC-25_ODP system components> is allocated.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!