id: "SC-03(05)" title: "Layered Structures" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-03.05" priority: "P1" implementation_level: "system" parent: "SC-03" enhancement: True
Statement
Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
Guidance
The implementation of layered structures with minimized interactions among security functions and non-looping layers (i.e., lower-layer functions do not depend on higher-layer functions) enables the isolation of security functions and the management of complexity.
Assessment Objective
security functions are implemented as a layered structure, minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
System and communications protection policy
procedures addressing security function isolation
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
Organizational processes for implementing security functions as a layered structure that minimizes interactions between layers and avoids dependence by lower layers on functionality/correctness of higher layers
mechanisms supporting and/or implementing security functions as a layered structure