SC-31(3)

Requirement

Measure the bandwidth of [Assignment: organization-defined subset of identified covert channels] in the operational environment of the system.

Discussion

Measuring covert channel bandwidth in specified operational environments helps organizations determine how much information can be covertly leaked before such leakage adversely affects mission or business functions. Covert channel bandwidth may be significantly different when measured in settings that are independent of the specific environments of operation, including laboratories or system development environments.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing covert channel analysis; system design documentation; system configuration settings and associated documentation; covert channel analysis documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with covert channel analysis responsibilities; system developers/integrators].

Test

[SELECT FROM: Organizational process for conducting covert channel analysis; mechanisms supporting and/or implementing covert channel analysis; mechanisms supporting and/or implementing the capability to measure the bandwidth of covert channels].

ID	Assessment Objectives
SC-31(03)	the bandwidth of <SC-31(03)_ODP subset of identified covert channels> is measured in the operational environment of the system.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!