SC-25 Thin Nodes
Guidance: nonePolicy clause: noneWhat these mean
sc25ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Not in a baseline | System | None |
Related controls: SC-30, SC-44
Control statement
Section titled “Control statement”Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].
NIST discussion
The deployment of system components with minimal functionality reduces the need to secure every endpoint and may reduce the exposure of information, systems, and services to attacks. Reduced or minimal functionality includes diskless nodes and thin client technologies.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for SC-25
Determine if:
- SC-25[01] minimal functionality for [Assignment: organization-defined system components] is employed;
- SC-25[02] minimal information storage on [Assignment: organization-defined system components] is allocated.
Examine: System and communications protection policy; procedures addressing use of thin nodes; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.
Interview: System/network administrators; organizational personnel with information security responsibilities.
Test: Mechanisms supporting and/or implementing thin nodes.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.