SC-2 Separation of System and User Functionality
Review SC-2
1. Set its parameters
No parameters to set for SC-2.
2. Record its status
Separate user functionality, including user interface services, from system management functionality.
Discussion
System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in [SA-8](#sa-8) , including [SA-8(1)](#sa-8.1), [SA-8(3)](#sa-8.3), [SA-8(4)](#sa-8.4), [SA-8(10)](#sa-8.10), [SA-8(12)](#sa-8.12), [SA-8(13)](#sa-8.13), [SA-8(14)](#sa-8.14) , and [SA-8(18)](#sa-8.18).
Enhancements
Review SC-2(1)
1. Set its parameters
No parameters to set for SC-2(1).
2. Record its status
Prevent the presentation of system management functionality at interfaces to non-privileged users.
Discussion
Preventing the presentation of system management functionality at interfaces to non-privileged users ensures that system administration options, including administrator privileges, are not available to the general user population. Restricting user access also prohibits the use of the grey-out option commonly used to eliminate accessibility to such information. One potential solution is to withhold system administration options until users establish sessions with administrator privileges.
Review SC-2(2)
1. Set its parameters
No parameters to set for SC-2(2).
2. Record its status
Store state information from applications and software separately.
Discussion
If a system is compromised, storing applications and software separately from state information about users’ interactions with an application may better protect individuals’ privacy.
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
No ISO 27001 mapping published for this control.