# System and Communications Protection Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/sc/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet SC-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SC-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for System and Communications Protection, and who is accountable for meeting those requirements. (SC-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business-process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SC-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (SC-1a.1(a))
- The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (SC-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (SC-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (SC-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (SC-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SC-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (SC-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (SC-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (SC-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (SC-1a.1(a))

## Procedures

The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (SC-1a.2)

## Dissemination

- The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the system and communications protection policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (SC-1a)
- The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the system and communications protection procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (SC-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Denial-of-service protection (SC-5)

> **Guidance:** Most organizations meet this through their internet or cloud provider's denial-of-service protection, plus rate limiting and autoscaling for their own services. Record which protections are inherited and which the system provides.

- The [System owner] shall ensure the system can [Select one: protect against; limit. Typical: protect against] the effects of the following types of denial-of-service events: [Fill in: types of denial-of-service events to be protected against or limited. Typical: network floods, protocol attacks and application-layer floods against internet-facing services]. (SC-5a)
- The [System owner] shall employ the following controls to achieve the denial-of-service objective: [Fill in: controls to achieve the denial-of-service objective by type of denial-of-service event. Typical: an upstream or cloud denial-of-service protection service for internet-facing services, rate limiting at load balancers and application gateways, and capacity that scales automatically]. (SC-5b)

### Boundary protection (SC-7)

> **Guidance:** Every external connection goes through a managed interface, such as a firewall, cloud security group, gateway or proxy, and public-facing components sit in their own subnetwork. The boundary diagram in the system security plan is where assessors start. The [Boundary Protection Standard](https://kston83.github.io/nist-guide/templates/standards/boundary-protection-standard/) sets the managed interfaces, rule sets, allowed flows and review cycle.

- The [System owner] shall monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system. (SC-7a)
- The [System owner] shall implement subnetworks for publicly accessible system components that are [Select one: physically; logically. Typical: logically] separated from internal organizational networks. (SC-7b)
- The [System owner] shall connect the system to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with the organization's security and privacy architecture. (SC-7c)

#### Federal systems

Federal civilian agencies secure their network connections under CISA's [Trusted Internet Connections (TIC) 3.0](https://www.cisa.gov/resources-tools/programs/trusted-internet-connections-tic) program, which implements OMB M-19-26, Update to the Trusted Internet Connections (TIC) Initiative (September 12, 2019). TIC 3.0 is set out in CISA's core guidance documents and use cases (as of September 2026).

- The [System owner] shall implement the system's external connections in accordance with the agency's TIC 3.0 architecture and the TIC 3.0 use cases that apply to the system. (SC-7c)

### Cryptographic key establishment and management (SC-12)

> **Guidance:** Key management is where encryption usually fails: keys stored with the data, or usable by every administrator. NIST SP 800-57 Part 1 is the usual reference for key management requirements. Cloud key management services and hardware security modules handle most of it; the system owner decides who can use and administer each key. The [Encryption and Key Management Standard](https://kston83.github.io/nist-guide/templates/standards/encryption-and-key-management-standard/) sets the key generation, storage, access, replacement and destruction requirements this clause refers to.

- The [System owner] shall establish and manage cryptographic keys, wherever the system employs cryptography, in accordance with [Fill in: requirements for key generation, distribution, storage, access, and destruction. Typical: the requirements for key generation, distribution, storage, access and destruction in the encryption and key management standard]. (SC-12)

### Cryptographic protection (SC-13)

> **Guidance:** SC-13 does not require cryptography by itself; SC-8, SC-28, IA-5 and AC-17 do. It sets the standard that cryptography must meet wherever those controls call for it. The cryptographic uses match those under configuration management in CM-3(6). The [Encryption and Key Management Standard](https://kston83.github.io/nist-guide/templates/standards/encryption-and-key-management-standard/) lists the approved algorithms, protocols and modules for each use.

- The [Chief Information Security Officer] shall determine the cryptographic uses for the organization's systems, which include [Fill in: cryptographic uses. Typical: encryption in transit and at rest, digital signatures and authentication]. (SC-13a)
- The [System owner] shall implement the following types of cryptography for each cryptographic use: [Fill in: types of cryptography for each specified cryptographic use. Typical: NIST-approved algorithms in cryptographic modules validated under FIPS 140-3 (or FIPS 140-2 for existing systems)]. (SC-13b)

#### Federal systems

[FIPS 140-3](https://csrc.nist.gov/pubs/fips/140-3/final) (March 22, 2019) "is applicable to all Federal agencies that use cryptography-based security systems to protect sensitive information", and modules validated under NIST's Cryptographic Module Validation Program (CMVP) are considered to conform to it (sections 6 and 9). The CMVP's [FIPS 140-3 transition page](https://csrc.nist.gov/projects/fips-140-3-transition-effort) sets the schedule for moving FIPS 140-2 validations to the Historical List in September 2026; modules on the Historical List remain supported for existing systems, but the standard notes that the Historical List "should not be used for procurement decisions" (as of September 2026).

- The [System owner] shall use cryptographic modules validated by the CMVP wherever the system uses cryptography to protect sensitive information. (SC-13b)
- The [System owner] shall select FIPS 140-3 validated modules for new systems and new purchases. (SC-13b)

### Collaborative computing devices and applications (SC-15)

> **Guidance:** Collaborative computing devices include cameras, microphones, networked whiteboards and conferencing applications. The point is that nobody can switch on a camera or microphone remotely without the people in the room knowing.

- The [System owner] shall prohibit remote activation of collaborative computing devices and applications, with these exceptions: [Fill in: exceptions where remote activation is to be allowed. Typical: none, except conference room equipment that support staff activate for maintenance with the room owner's approval]. (SC-15a)
- The [System owner] shall ensure collaborative computing devices and applications give an explicit indication of use to users physically present at the devices. (SC-15b)

### Secure name and address resolution service (authoritative source) (SC-20)

> **Guidance:** In practice this is DNSSEC signing for the zones the organization publishes, often a setting at the managed DNS provider. [NIST SP 800-81 Rev. 3](https://csrc.nist.gov/pubs/sp/800/81/r3/final), Secure Domain Name System (DNS) Deployment Guide (March 2026), is the NIST guide to deploying DNS securely, including DNSSEC.

- The [System owner] shall ensure the system provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data it returns in response to external name and address resolution queries. (SC-20a)
- When the system operates as part of a distributed, hierarchical namespace, the [System owner] shall ensure it provides the means to indicate the security status of child zones and, if a child supports secure resolution services, to enable verification of a chain of trust among parent and child domains. (SC-20b)

### Secure name and address resolution service (recursive or caching resolver) (SC-21)

> **Guidance:** In practice this is DNSSEC validation turned on at the resolvers the system uses, or a DNS service that validates.

- The [System owner] shall ensure the system requests and performs data origin authentication and data integrity verification on the name and address resolution responses it receives from authoritative sources. (SC-21)

### Architecture and provisioning for name and address resolution service (SC-22)

> **Guidance:** Fault tolerance means at least two name servers in different network locations. Role separation means internal and external name servers are separate, so internal names are not published to the internet.

- The [System owner] shall ensure the systems that together provide name and address resolution service for the organization are fault-tolerant and implement internal and external role separation. (SC-22)

### Process isolation (SC-39)

> **Guidance:** Modern operating systems, hypervisors and container platforms provide separate execution domains; this control is usually inherited. Confirm it for any component that does not, such as some embedded or legacy systems.

- The [System owner] shall ensure the system maintains a separate execution domain for each executing system process. (SC-39)

## Review and update

- The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current system and communications protection policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current system and communications protection policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (SC-1c.1)
- The [Fill in: an official to manage the system and communications protection policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current system and communications protection procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the system and communications protection procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (SC-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SC-1a.1(b))