SC-48 Sensor Relocation

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	1 (0 in a baseline)

Related controls: AU-2, SC-7, SI-4

Control statement

Relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organization-defined conditions or circumstances].

NIST discussion

Adversaries may take various paths and use different approaches as they move laterally through an organization (including its systems) to reach their target or as they attempt to exfiltrate information from the organization. The organization often only has a limited set of monitoring and detection capabilities, and they may be focused on the critical or likely infiltration or exfiltration paths. By using communications paths that the organization typically does not monitor, the adversary can increase its chances of achieving its desired goals. By relocating its sensors or monitoring capabilities to new locations, the organization can impede the adversary’s ability to achieve its goals. The relocation of the sensors or monitoring capabilities might be done based on threat information that the organization has acquired or randomly to confuse the adversary and make its lateral transition through the system or organization more challenging.

Control enhancements

SC-48(1) Dynamic Relocation of Sensors or Monitoring Capabilities

Baselines: Not in a baseline

Dynamically relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organization-defined conditions or circumstances].

Discussion and assessment objectives for SC-48(1)

None.

Determine if [Assignment: organization-defined sensors and monitoring capabilities] are dynamically relocated to [Assignment: organization-defined locations] under [Assignment: organization-defined conditions or circumstances].

Examine: System and communications protection policy; procedures addressing sensor and monitoring capability relocation; list of sensors/monitoring capabilities to be relocated; change control records; configuration management records; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system.

Test: SELECT FROM: Mechanisms supporting and/or implementing sensor relocation.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-48

Determine if [Assignment: organization-defined sensors and monitoring capabilities] are relocated to [Assignment: organization-defined locations] under [Assignment: organization-defined conditions or circumstances].

Examine: System and communications protection policy; procedures addressing sensor and monitoring capability relocation; list of sensors/monitoring capabilities to be relocated; change control records; configuration management records; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system.

Test: Mechanisms supporting and/or implementing sensor relocation.