SC-4(2)

Requirement

Prevent unauthorized information transfer via shared resources in accordance with [Assignment: organization-defined procedures] when system processing explicitly switches between different information classification levels or security categories.

Discussion

Changes in processing levels can occur during multilevel or periods processing with information at different classification levels or security categories. It can also occur during serial reuse of hardware components at different classification levels. Organization-defined procedures can include approved sanitization processes for electronically stored information.

Title

Information in Shared System Resources | Multilevel or Periods Processing
Family

System and Communications Protection
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing information protection in shared system resources; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developer].

Test

[SELECT FROM: Mechanisms preventing the unauthorized transfer of information via shared system resources].

ID	Assessment Objectives
SC-04(02)	unauthorized information transfer via shared resources is prevented in accordance with <SC-04(02)_ODP procedures> when system processing explicitly switches between different information classification levels or security categories.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!