---

id: "SC-37" title: "Out-of-band Channels" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-37" priority: "P1" implementation_level: "organization" enhancements: - sc-37.1

---

Statement

Employ the following out-of-band channels for the physical delivery or electronic transmission of {{ insert: param, sc-37_odp.02 }} to {{ insert: param, sc-37_odp.03 }}: {{ insert: param, sc-37_odp.01 }}.

Guidance

Out-of-band channels include local, non-network accesses to systems; network paths physically separate from network paths used for operational traffic; or non-electronic paths, such as the U.S. Postal Service. The use of out-of-band channels is contrasted with the use of in-band channels (i.e., the same channels) that carry routine operational traffic. Out-of-band channels do not have the same vulnerability or exposure as in-band channels. Therefore, the confidentiality, integrity, or availability compromises of in-band channels will not compromise or adversely affect the out-of-band channels. Organizations may employ out-of-band channels in the delivery or transmission of organizational items, including authenticators and credentials; cryptographic key management information; system and data backups; configuration management changes for hardware, firmware, or software; security updates; maintenance information; and malicious code protection updates. For example, cryptographic keys for encrypted files are delivered using a different channel than the file.

Assessment Objective

{{ insert: param, sc-37_odp.01 }} are employed for the physical delivery or electronic transmission of {{ insert: param, sc-37_odp.02 }} to {{ insert: param, sc-37_odp.03 }}.

System and communications protection policy

procedures addressing the use of out-of-band channels

access control policy and procedures

identification and authentication policy and procedures

system design documentation

system architecture

system configuration settings and associated documentation

list of out-of-band channels

types of information, system components, or devices requiring the use of out-of-band channels for physical delivery or electronic transmission to authorized individuals or systems

physical delivery records

electronic transmission records

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel authorizing, installing, configuring, operating, and/or using out-of-band channels

system developers/integrators

Organizational processes for the use of out-of-band channels

mechanisms supporting and/or implementing the use of out-of-band channels