SC-51 Hardware-based Protection

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	None

Control statement

• a. Employ hardware-based, write-protect for [Assignment: organization-defined system firmware components] ; and
• b. Implement specific procedures for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.

NIST discussion

None.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-51

Determine if:

• SC-51a. hardware-based write-protect for [Assignment: organization-defined system firmware components] is employed;
• SC-51b.
  • SC-51b.[01] specific procedures are implemented for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications;
  • SC-51b.[02] specific procedures are implemented for [Assignment: organization-defined authorized individuals] to re-enable the write-protect prior to returning to operational mode.

Examine: System and communications protection policy; procedures addressing firmware modifications; system design documentation; system configuration settings and associated documentation; system architecture; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; system developers/integrators.

Test: Organizational processes for modifying system firmware; mechanisms supporting and/or implementing hardware-based write-protection for system firmware.