id: "SC-46" title: "Cross Domain Policy Enforcement" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-46" priority: "P1" implementation_level: "system"
Statement
Implement a policy enforcement mechanism {{ insert: param, sc-46_odp }} between the physical and/or network interfaces for the connecting security domains.
Guidance
For logical policy enforcement mechanisms, organizations avoid creating a logical path between interfaces to prevent the ability to bypass the policy enforcement mechanism. For physical policy enforcement mechanisms, the robustness of physical isolation afforded by the physical implementation of policy enforcement to preclude the presence of logical covert channels penetrating the security domain may be needed. Contact ncdsmo@nsa.gov for more information.
Assessment Objective
a policy enforcement mechanism is {{ insert: param, sc-46_odp }} implemented between the physical and/or network interfaces for the connecting security domains.
System and communications protection policy
procedures addressing cross-domain policy enforcement
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
Mechanisms supporting and/or implementing cross-domain policy enforcement