---

id: "SC-07(22)" title: "Separate Subnets for Connecting to Different Security Domains" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-07.22" priority: "P1" implementation_level: "system" parent: "SC-07" enhancement: True

---

Statement

Implement separate network addresses to connect to systems in different security domains.

Guidance

The decomposition of systems into subnetworks (i.e., subnets) helps to provide the appropriate level of protection for network connections to different security domains that contain information with different security categories or classification levels.

Assessment Objective

separate network addresses are implemented to connect to systems in different security domains.

System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Mechanisms supporting and/or implementing separate network addresses/different subnets