SC-39 Process isolation
Requires a separate execution domain to be maintained for each executing process, so that one process cannot read or interfere with the memory and execution state of another.
4
artefacts
1
held by a system
2
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence for virtualisation, container or operating system isolation features · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Assessment of shared tenancy risks and the isolation relied upon · Document repository
- Evidence isolation features remain enabled after platform changes · Document repository
governing documentDocuments that govern the control
- Documentation of the platform mechanisms providing per process isolation · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Containers on a shared kernel treated as equivalent to full isolation without analysis
- Isolation features disabled for performance and never reinstated
- Legacy applications running privileged so isolation boundaries are moot
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-38 Operations Security. Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [organization-defined] · SC-40 Wireless Link Protection. Protect external and internal [organization-defined] from the following signal parameter attacks: [organization-defined]