SC-21 Secure name/address resolution service (recursive)
Requires the system, when acting as a recursive or caching resolver, to request and perform data origin authentication and integrity verification on the name resolution responses it receives from authoritative sources.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Resolver configuration showing validation of responses is enabled · Cloud console / configuration management
- Monitoring or logs of validation failures · SIEM / log platform
periodic reviewEvidence produced at each review
- Test evidence that deliberately invalid responses are rejected · Document repository
governing documentDocuments that govern the control
- Inventory of resolvers in use, including those provided by cloud platforms · Policy repository / GRC workspace
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Validation enabled on central resolvers while endpoints use unvalidated public resolvers
- Validation disabled to work around a broken zone and never re-enabled
- Failures unmonitored, so a silent loss of validation is invisible
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-20 Secure name/address resolution service · SC-22 Architecture and provisioning for name/address resolution service