---

id: "SC-07(29)" title: "Separate Subnets to Isolate Functions" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-07.29" priority: "P1" implementation_level: "system" parent: "SC-07" enhancement: True

---

Statement

Implement {{ insert: param, sc-07.29_odp.01 }} separate subnetworks to isolate the following critical system components and functions: {{ insert: param, sc-07.29_odp.02 }}.

Guidance

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.

Assessment Objective

subnetworks are separated {{ insert: param, sc-07.29_odp.01 }} to isolate {{ insert: param, sc-07.29_odp.02 }}.

System and communications protection policy

procedures addressing boundary protection

system design documentation

system hardware and software

system architecture

system configuration settings and associated documentation

criticality analysis

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

system developer

organizational personnel with boundary protection responsibilities

Mechanisms separating critical system components and functions