---

id: "SC-07(16)" title: "Prevent Discovery of System Components" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-07.16" priority: "P1" implementation_level: "system" parent: "SC-07" enhancement: True

---

Statement

Prevent the discovery of specific system components that represent a managed interface.

Guidance

Preventing the discovery of system components representing a managed interface helps protect network addresses of those components from discovery through common tools and techniques used to identify devices on networks. Network addresses are not available for discovery and require prior knowledge for access. Preventing the discovery of components and devices can be accomplished by not publishing network addresses, using network address translation, or not entering the addresses in domain name systems. Another prevention technique is to periodically change network addresses.

Assessment Objective

the discovery of specific system components that represent a managed interface is prevented.

System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Mechanisms supporting and/or implementing the prevention of discovery of system components at managed interfaces