SC-43 Usage Restrictions

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Related controls: AC-18, AC-19, CM-6, SC-7, SC-18

Control statement

• a. Establish usage restrictions and implementation guidelines for the following system components: [Assignment: organization-defined components] ; and
• b. Authorize, monitor, and control the use of such components within the system.

NIST discussion

Usage restrictions apply to all system components including but not limited to mobile code, mobile devices, wireless access, and wired and wireless peripheral components (e.g., copiers, printers, scanners, optical devices, and other similar technologies). The usage restrictions and implementation guidelines are based on the potential for system components to cause damage to the system and help to ensure that only authorized system use occurs.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-43

Determine if:

• SC-43a. usage restrictions and implementation guidelines are established for [Assignment: organization-defined components];
• SC-43b.
  • SC-43b.[01] the use of [Assignment: organization-defined components] is authorized within the system;
  • SC-43b.[02] the use of [Assignment: organization-defined components] is monitored within the system;
  • SC-43b.[03] the use of [Assignment: organization-defined components] is controlled within the system.

Examine: System and communications protection policy; usage restrictions; procedures addressing usage restrictions; implementation policy and procedures; authorization records; system monitoring records; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system.

Test: Organizational processes for authorizing, monitoring, and controlling the use of components with usage restrictions; mechanisms supporting and/or implementing, authorizing, monitoring, and controlling the use of components with usage restrictions.