id: "SC-08(03)" title: "Cryptographic Protection for Message Externals" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-08.03" priority: "P1" implementation_level: "system" parent: "SC-08" enhancement: True
Statement
Implement cryptographic mechanisms to protect message externals unless otherwise protected by {{ insert: param, sc-08.03_odp }}.
Guidance
Cryptographic protection for message externals addresses protection from the unauthorized disclosure of information. Message externals include message headers and routing information. Cryptographic protection prevents the exploitation of message externals and applies to internal and external networks or links that may be visible to individuals who are not authorized users. Header and routing information is sometimes transmitted in clear text (i.e., unencrypted) because the information is not identified by organizations as having significant value or because encrypting the information can result in lower network performance or higher costs. Alternative physical controls include protected distribution systems.
Assessment Objective
cryptographic mechanisms are implemented to protect message externals unless otherwise protected by {{ insert: param, sc-08.03_odp }}.
System and communications protection policy
procedures addressing transmission confidentiality and integrity
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developer
Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity for message externals
mechanisms supporting and/or implementing alternative physical safeguards
organizational processes for defining and implementing alternative physical safeguards