SC-20 Secure name/address resolution service
Requires the system, when it is the authoritative source for name resolution, to return origin authentication and integrity artefacts with its responses, and within a hierarchical namespace to publish the security status
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Validation output showing origin authentication artefacts are returned · Identity provider / directory
periodic reviewEvidence produced at each review
- Configuration evidence for signed authoritative zones · Cloud console / configuration management
governing documentDocuments that govern the control
- Records showing delegation material for child zones is published and current · Document repository
- Key management and rollover procedures for zone signing · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Signing enabled for the main zone while subdomains and delegations are unsigned
- Key rollover unmanaged, so validation breaks or signing is quietly abandoned
- Chain of trust broken at delegation because parent records were not updated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-18 Mobile Code. Define acceptable and unacceptable mobile code and mobile code technologies; and Authorize, monitor, and control the use of mobile code within the system · SC-21 Secure name/address resolution service (recursive)