System and Communications Protection Policy

System and Communications Protection Policy template: Ready-to-adopt System and Communications Protection policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The System and Communications Protection policy states what the organization requires for system and communications protection and who is accountable for it. It meets SC-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. SC-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
SC-1	Policy and Procedures	Yes	Yes	Yes	Yes
SC-2	Separation of System and User Functionality		Yes	Yes
SC-3	Security Function Isolation			Yes
SC-4	Information in Shared System Resources		Yes	Yes
SC-5	Denial-of-service Protection	Yes	Yes	Yes
SC-7	Boundary Protection	Yes	Yes	Yes
SC-7(3)	Access Points		Yes	Yes
SC-7(4)	External Telecommunications Services		Yes	Yes
SC-7(5)	Deny by Default — Allow by Exception		Yes	Yes
SC-7(7)	Split Tunneling for Remote Devices		Yes	Yes
SC-7(8)	Route Traffic to Authenticated Proxy Servers		Yes	Yes
SC-7(18)	Fail Secure			Yes
SC-7(21)	Isolation of System Components			Yes
SC-7(24)	Personally Identifiable Information				Yes
SC-8	Transmission Confidentiality and Integrity		Yes	Yes
SC-8(1)	Cryptographic Protection		Yes	Yes
SC-10	Network Disconnect		Yes	Yes
SC-12	Cryptographic Key Establishment and Management	Yes	Yes	Yes
SC-12(1)	Availability			Yes
SC-13	Cryptographic Protection	Yes	Yes	Yes
SC-15	Collaborative Computing Devices and Applications	Yes	Yes	Yes
SC-17	Public Key Infrastructure Certificates		Yes	Yes
SC-18	Mobile Code		Yes	Yes
SC-20	Secure Name/Address Resolution Service (Authoritative Source)	Yes	Yes	Yes
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Yes	Yes	Yes
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Yes	Yes	Yes
SC-23	Session Authenticity		Yes	Yes
SC-24	Fail in Known State			Yes
SC-28	Protection of Information at Rest		Yes	Yes
SC-28(1)	Cryptographic Protection		Yes	Yes
SC-39	Process Isolation	Yes	Yes	Yes

Decisions to make first

The policy has 36 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Which algorithms, key lengths and cryptographic modules are approved for each use, and where is the list kept?	SC-8, SC-12, SC-13, SC-28	An encryption and key management standard listing each use with its approved algorithms and validated modules, owned by the security team and reviewed each year.	Chief Information Security Officer
Which managed interfaces protect each system, and which are shared across the organization?	SC-7	The enterprise perimeter, the internet connection and the cloud landing zone are common controls; each system owns its security groups, application firewall rules and internal segmentation.	Chief Information Security Officer
Who issues certificates, and which certificate authorities do systems trust?	SC-17	Public certificate authorities for internet-facing services; an internal certificate authority under the organization’s certificate policy for internal services; trust stores limited to an approved list.	Chief Information Security Officer
Which protections does each system inherit from its cloud or hosting provider?	SC-4, SC-5, SC-39	Recorded in the inheritance table of the system security plan, from the provider’s customer responsibility matrix.	System owner

Record your values in the System and Communications Protection decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: SC pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet SC-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SC-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for System and Communications Protection, and who is accountable for meeting those requirements. (SC-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business-process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SC-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (SC-1a.1(a))
• The Fill in: an official to manage the system and communications protection policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (SC-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (SC-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (SC-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (SC-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SC-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (SC-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (SC-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (SC-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (SC-1a.1(a))

Procedures

The Fill in: an official to manage the system and communications protection policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (SC-1a.2)

Dissemination

• The Fill in: an official to manage the system and communications protection policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the system and communications protection policy is to be disseminated Typical: everyone within its scope, through the policy library. (SC-1a)
• The Fill in: an official to manage the system and communications protection policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the system and communications protection procedures are to be disseminated Typical: the people who carry them out, and the system owners. (SC-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Separation of system and user functionality (SC-2)

Guidance

Keep administration interfaces apart from the interfaces users see: separate administrative consoles, ports or network segments, separate administrator accounts, and management planes not reachable from user networks or the internet.

• The System owner shall ensure the system separates user functionality, including user interface services, from system management functionality. (SC-2)

Information in shared system resources (SC-4)

Guidance

This control is about residual information: memory, storage and caches reused by another user or process must not reveal what the last one left. Operating systems and cloud platforms usually provide it; the system owner confirms it and covers any shared resources the application manages itself.

• The System owner shall ensure the system prevents unauthorized and unintended information transfer through shared system resources. (SC-4)

Denial-of-service protection (SC-5)

Guidance

Most organizations meet this through their internet or cloud provider’s denial-of-service protection, plus rate limiting and autoscaling for their own services. Record which protections are inherited and which the system provides.

• The System owner shall ensure the system can Select one: protect against; limit Typical: protect against the effects of the following types of denial-of-service events: Fill in: types of denial-of-service events to be protected against or limited Typical: network floods, protocol attacks and application-layer floods against internet-facing services. (SC-5a)
• The System owner shall employ the following controls to achieve the denial-of-service objective: Fill in: controls to achieve the denial-of-service objective by type of denial-of-service event Typical: an upstream or cloud denial-of-service protection service for internet-facing services, rate limiting at load balancers and application gateways, and capacity that scales automatically. (SC-5b)

Boundary protection (SC-7)

Guidance

Every external connection goes through a managed interface, such as a firewall, cloud security group, gateway or proxy, and public-facing components sit in their own subnetwork. The boundary diagram in the system security plan is where assessors start. The Boundary Protection Standard sets the managed interfaces, rule sets, allowed flows and review cycle.

• The System owner shall monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system. (SC-7a)
• The System owner shall implement subnetworks for publicly accessible system components that are Select one: physically; logically Typical: logically separated from internal organizational networks. (SC-7b)
• The System owner shall connect the system to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with the organization’s security and privacy architecture. (SC-7c)

Federal systems

Federal civilian agencies secure their network connections under CISA’s Trusted Internet Connections (TIC) 3.0 program, which implements OMB M-19-26, Update to the Trusted Internet Connections (TIC) Initiative (September 12, 2019). TIC 3.0 is set out in CISA’s core guidance documents and use cases (as of September 2026).

• The System owner shall implement the system’s external connections in accordance with the agency’s TIC 3.0 architecture and the TIC 3.0 use cases that apply to the system. (SC-7c)

Access points (SC-7(3))

• The System owner shall limit the number of external network connections to the system. (SC-7(3))

External telecommunications services (SC-7(4))

Guidance

Control plane traffic is the routing and signaling traffic between networks, such as BGP route announcements. Items (f) to (h) usually fall to the network or internet service team: route filtering, and publishing the organization’s address space and routing policy so others can detect hijacked routes.

• The System owner shall implement a managed interface for each external telecommunication service. (SC-7(4)(a))
• The System owner shall establish a traffic flow policy for each managed interface. (SC-7(4)(b))
• The System owner shall protect the confidentiality and integrity of the information transmitted across each interface. (SC-7(4)(c))
• The System owner shall document each exception to the traffic flow policy with the mission or business need that supports it and the duration of that need. (SC-7(4)(d))
• The System owner shall review exceptions to the traffic flow policy Fill in: the frequency at which to review exceptions to traffic flow policy Typical: at least annually, and when the system changes, and remove exceptions that an explicit mission or business need no longer supports. (SC-7(4)(e))
• The System owner shall prevent unauthorized exchange of control plane traffic with external networks. (SC-7(4)(f))
• The System owner shall publish information that enables remote networks to detect unauthorized control plane traffic from internal networks. (SC-7(4)(g))
• The System owner shall filter unauthorized control plane traffic from external networks. (SC-7(4)(h))

Deny by default, allow by exception (SC-7(5))

• The System owner shall ensure network communications traffic is denied by default and allowed by exception Select one or more: at managed interfaces; for [Assignment: organization-defined systems] Typical: at managed interfaces. (SC-7(5))

Split tunneling for remote devices (SC-7(7))

Guidance

Split tunneling lets a remote device reach the internet directly while connected to the organization’s network, bypassing its boundary protections. Where a zero trust access service replaces the virtual private network, record how its design meets the intent.

• The System owner shall prevent split tunneling for remote devices connecting to organizational systems, except where the split tunnel is securely provisioned using these safeguards: Fill in: safeguards to securely provision split tunneling Typical: none; split tunneling is disabled for organization-managed remote devices. (SC-7(7))

Route traffic to authenticated proxy servers (SC-7(8))

• The System owner shall route Fill in: internal communications traffic to be routed to external networks Typical: outbound web traffic from internal users to Fill in: external networks to which internal communications traffic is to be routed Typical: the internet through authenticated proxy servers at managed interfaces. (SC-7(8))

Transmission confidentiality and integrity (SC-8)

Guidance

Protect information while it moves, inside the system as well as across its boundary. At Moderate and High, SC-8(1) makes that protection cryptographic, using the cryptography SC-13 requires.

• The System owner shall ensure the system protects the Select one or more: confidentiality; integrity Typical: confidentiality and integrity of transmitted information. (SC-8)

Federal systems

CISA Binding Operational Directive 18-01, Enhance Email and Web Security (October 16, 2017), requires that “All publicly accessible Federal websites and web services provide service through a secure connection (HTTPS-only, with HSTS)”, that internet-facing mail servers offer STARTTLS, and that SSLv2, SSLv3, 3DES and RC4 are disabled on mail servers. CISA’s directive page does not mark it revoked (as of September 2026).

• The System owner shall ensure each publicly accessible website and web service of the system provides service only through HTTPS, with HTTP Strict Transport Security. (SC-8)
• The System owner shall ensure each internet-facing mail server of the system offers STARTTLS. (SC-8)
• The System owner shall ensure SSLv2, SSLv3 and the 3DES and RC4 ciphers are disabled on the system’s mail servers. (SC-8)

Cryptographic protection (SC-8(1))

Guidance

In practice: TLS 1.2 or later for web, API and database connections, SSH for administration, IPsec or TLS for virtual private networks, and encryption on internal service-to-service traffic. Cleartext protocols such as Telnet and unencrypted FTP are disabled.

• The System owner shall implement cryptographic mechanisms to Select one or more: prevent unauthorized disclosure of information; detect changes to information Typical: prevent unauthorized disclosure of information and detect changes to information during transmission. (SC-8(1))

Network disconnect (SC-10)

Guidance

SC-10 ends the network connection; AC-12 ends the user’s session. Keep the two times consistent: the typical value here matches the 30 minutes AC-12 sets for remote and web sessions.

• The System owner shall ensure the system terminates the network connection associated with a communications session at the end of the session or after Fill in: a time period of inactivity after which the system terminates a network connection associated with a communication session Typical: 30 minutes of inactivity. (SC-10)

Cryptographic key establishment and management (SC-12)

Guidance

Key management is where encryption usually fails: keys stored with the data, or usable by every administrator. NIST SP 800-57 Part 1 is the usual reference for key management requirements. Cloud key management services and hardware security modules handle most of it; the system owner decides who can use and administer each key. The Encryption and Key Management Standard sets the key generation, storage, access, replacement and destruction requirements this clause refers to.

• The System owner shall establish and manage cryptographic keys, wherever the system employs cryptography, in accordance with Fill in: requirements for key generation, distribution, storage, access, and destruction Typical: the requirements for key generation, distribution, storage, access and destruction in the encryption and key management standard. (SC-12)

Cryptographic protection (SC-13)

Guidance

SC-13 does not require cryptography by itself; SC-8, SC-28, IA-5 and AC-17 do. It sets the standard that cryptography must meet wherever those controls call for it. The cryptographic uses match those under configuration management in CM-3(6). The Encryption and Key Management Standard lists the approved algorithms, protocols and modules for each use.

• The Chief Information Security Officer shall determine the cryptographic uses for the organization’s systems, which include Fill in: cryptographic uses Typical: encryption in transit and at rest, digital signatures and authentication. (SC-13a)
• The System owner shall implement the following types of cryptography for each cryptographic use: Fill in: types of cryptography for each specified cryptographic use Typical: NIST-approved algorithms in cryptographic modules validated under FIPS 140-3 (or FIPS 140-2 for existing systems). (SC-13b)

Federal systems

FIPS 140-3 (March 22, 2019) “is applicable to all Federal agencies that use cryptography-based security systems to protect sensitive information”, and modules validated under NIST’s Cryptographic Module Validation Program (CMVP) are considered to conform to it (sections 6 and 9). The CMVP’s FIPS 140-3 transition page sets the schedule for moving FIPS 140-2 validations to the Historical List in September 2026; modules on the Historical List remain supported for existing systems, but the standard notes that the Historical List “should not be used for procurement decisions” (as of September 2026).

• The System owner shall use cryptographic modules validated by the CMVP wherever the system uses cryptography to protect sensitive information. (SC-13b)
• The System owner shall select FIPS 140-3 validated modules for new systems and new purchases. (SC-13b)

Collaborative computing devices and applications (SC-15)

Guidance

Collaborative computing devices include cameras, microphones, networked whiteboards and conferencing applications. The point is that nobody can switch on a camera or microphone remotely without the people in the room knowing.

• The System owner shall prohibit remote activation of collaborative computing devices and applications, with these exceptions: Fill in: exceptions where remote activation is to be allowed Typical: none, except conference room equipment that support staff activate for maintenance with the room owner’s approval. (SC-15a)
• The System owner shall ensure collaborative computing devices and applications give an explicit indication of use to users physically present at the devices. (SC-15b)

Public key infrastructure certificates (SC-17)

Guidance

Most organizations obtain certificates for public services from a public certificate authority, which counts as an approved service provider, and run an internal certificate authority under their own certificate policy for internal services. Trust stores should hold only the trust anchors the organization approves.

• The Chief Information Security Officer shall ensure public key certificates are issued under Fill in: a certificate policy for issuing public key certificates Typical: the organization’s certificate policy, or obtained from an approved service provider. (SC-17a)
• The System owner shall include only approved trust anchors in trust stores or certificate stores the organization manages. (SC-17b)

Mobile code (SC-18)

Guidance

Mobile code is software sent from a remote system and run on a local one, such as JavaScript, macros in office documents and browser plug-ins. Define what is acceptable by technology, for example signed macros only and no browser plug-ins, and enforce it through browser and office application settings.

• The Chief Information Security Officer shall define acceptable and unacceptable mobile code and mobile code technologies. (SC-18a)
• The System owner shall authorize, monitor and control the use of mobile code within the system. (SC-18b)

Secure name and address resolution service (authoritative source) (SC-20)

Guidance

In practice this is DNSSEC signing for the zones the organization publishes, often a setting at the managed DNS provider. NIST SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide (March 2026), is the NIST guide to deploying DNS securely, including DNSSEC.

• The System owner shall ensure the system provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data it returns in response to external name and address resolution queries. (SC-20a)
• When the system operates as part of a distributed, hierarchical namespace, the System owner shall ensure it provides the means to indicate the security status of child zones and, if a child supports secure resolution services, to enable verification of a chain of trust among parent and child domains. (SC-20b)

Secure name and address resolution service (recursive or caching resolver) (SC-21)

Guidance

In practice this is DNSSEC validation turned on at the resolvers the system uses, or a DNS service that validates.

• The System owner shall ensure the system requests and performs data origin authentication and data integrity verification on the name and address resolution responses it receives from authoritative sources. (SC-21)

Architecture and provisioning for name and address resolution service (SC-22)

Guidance

Fault tolerance means at least two name servers in different network locations. Role separation means internal and external name servers are separate, so internal names are not published to the internet.

• The System owner shall ensure the systems that together provide name and address resolution service for the organization are fault-tolerant and implement internal and external role separation. (SC-22)

Session authenticity (SC-23)

Guidance

Session authenticity protects against session hijacking and replay: TLS with certificate validation, session identifiers that are random and expire, and invalidating session identifiers at logout.

• The System owner shall ensure the system protects the authenticity of communications sessions. (SC-23)

Protection of information at rest (SC-28)

Guidance

Protect stored information on servers, in databases and storage services, in backups and on end-user devices. At Moderate and High, SC-28(1) makes the protection cryptographic.

• The System owner shall ensure the system protects the Select one or more: confidentiality; integrity Typical: confidentiality and integrity of Fill in: information at rest requiring protection Typical: all information stored by the system, including backups. (SC-28)

Cryptographic protection (SC-28(1))

Guidance

Encryption at rest protects against lost devices, stolen media and direct access to storage; it does not protect against someone who can sign in to the application. Keep keys apart from the data they protect.

• The System owner shall implement cryptographic mechanisms to prevent unauthorized disclosure and modification of Fill in: information requiring cryptographic protection Typical: all organizational information at rest on Fill in: system components or media requiring cryptographic protection Typical: servers, databases, storage services, backups, end-user devices and removable media. (SC-28(1))

Process isolation (SC-39)

Guidance

Modern operating systems, hypervisors and container platforms provide separate execution domains; this control is usually inherited. Confirm it for any component that does not, such as some embedded or legacy systems.

• The System owner shall ensure the system maintains a separate execution domain for each executing system process. (SC-39)

Review and update

• The Fill in: an official to manage the system and communications protection policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current system and communications protection policy is reviewed and updated Typical: annually and following Fill in: events that would require the current system and communications protection policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (SC-1c.1)
• The Fill in: an official to manage the system and communications protection policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current system and communications protection procedures are reviewed and updated Typical: annually and following Fill in: events that would require the system and communications protection procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (SC-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SC-1a.1(b))