System and Communications Protection Decision Worksheet

System and Communications Protection Decision Worksheet template: Every decision the System and Communications Protection family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the System and Communications Protection family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every SC control in the baseline, with a typical value where the System and Communications Protection Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

34 decisions.

Decision	Control	Typical value	Who decides
Which algorithms, key lengths and cryptographic modules are approved for each use, and where is the list kept?	SC-8, SC-12, SC-13, SC-28	An encryption and key management standard listing each use with its approved algorithms and validated modules, owned by the security team and reviewed each year.	Chief Information Security Officer
Which managed interfaces protect each system, and which are shared across the organization?	SC-7	The enterprise perimeter, the internet connection and the cloud landing zone are common controls; each system owns its security groups, application firewall rules and internal segmentation.	Chief Information Security Officer
Who issues certificates, and which certificate authorities do systems trust?	SC-17	Public certificate authorities for internet-facing services; an internal certificate authority under the organization’s certificate policy for internal services; trust stores limited to an approved list.	Chief Information Security Officer
Which protections does each system inherit from its cloud or hosting provider?	SC-4, SC-5, SC-39	Recorded in the inheritance table of the system security plan, from the provider’s customer responsibility matrix.	System owner
Personnel or roles to whom the system and communications protection policy is to be disseminated	SC-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the system and communications protection procedures are to be disseminated	SC-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business-process-level; system-level	SC-1	Organization-level	Chief Information Security Officer
An official to manage the system and communications protection policy and procedures	SC-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current system and communications protection policy is reviewed and updated	SC-1	Annually	Chief Information Security Officer
Events that would require the current system and communications protection policy to be reviewed and updated	SC-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current system and communications protection procedures are reviewed and updated	SC-1	Annually	Chief Information Security Officer
Events that would require the system and communications protection procedures to be reviewed and updated	SC-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Types of denial-of-service events to be protected against or limited	SC-5	Network floods, protocol attacks and application-layer floods against internet-facing services	Chief Information Security Officer
Select one: protect against; limit	SC-5	Protect against	Chief Information Security Officer
Controls to achieve the denial-of-service objective by type of denial-of-service event	SC-5	An upstream or cloud denial-of-service protection service for internet-facing services, rate limiting at load balancers and application gateways, and capacity that scales automatically	Chief Information Security Officer
Select one: physically; logically	SC-7	Logically	Chief Information Security Officer
The frequency at which to review exceptions to traffic flow policy	SC-7(4)	At least annually, and when the system changes	Chief Information Security Officer
Select one or more: at managed interfaces; for organization-defined systems (see its row below)	SC-7(5)	At managed interfaces	Chief Information Security Officer
Systems for which network communications traffic is denied by default and network communications traffic is allowed by exception	SC-7(5)	See the selection above	Chief Information Security Officer
Safeguards to securely provision split tunneling	SC-7(7)	None; split tunneling is disabled for organization-managed remote devices	Chief Information Security Officer
Internal communications traffic to be routed to external networks	SC-7(8)	Outbound web traffic from internal users	Chief Information Security Officer
External networks to which internal communications traffic is to be routed	SC-7(8)	The internet	Chief Information Security Officer
Select one or more: confidentiality; integrity	SC-8	Confidentiality and integrity	Chief Information Security Officer
Select one or more: prevent unauthorized disclosure of information; detect changes to information	SC-8(1)	Prevent unauthorized disclosure of information and detect changes to information	Chief Information Security Officer
A time period of inactivity after which the system terminates a network connection associated with a communication session	SC-10	30 minutes	Chief Information Security Officer
Requirements for key generation, distribution, storage, access, and destruction	SC-12	The requirements for key generation, distribution, storage, access and destruction in the encryption and key management standard	Chief Information Security Officer
Cryptographic uses	SC-13	Encryption in transit and at rest, digital signatures and authentication	Chief Information Security Officer
Types of cryptography for each specified cryptographic use	SC-13	NIST-approved algorithms in cryptographic modules validated under FIPS 140-3 (or FIPS 140-2 for existing systems)	Chief Information Security Officer
Exceptions where remote activation is to be allowed	SC-15	None, except conference room equipment that support staff activate for maintenance with the room owner’s approval	Chief Information Security Officer
A certificate policy for issuing public key certificates	SC-17	The organization’s certificate policy	Chief Information Security Officer
Select one or more: confidentiality; integrity	SC-28	Confidentiality and integrity	Chief Information Security Officer
Information at rest requiring protection	SC-28	All information stored by the system, including backups	Chief Information Security Officer
Information requiring cryptographic protection	SC-28(1)	All organizational information	Chief Information Security Officer
System components or media requiring cryptographic protection	SC-28(1)	Servers, databases, storage services, backups, end-user devices and removable media	Chief Information Security Officer