SC-47 Alternate Communications Paths. Establish [organization-defined] for system operations organizational command and control
Alternate Communications Paths. Establish [organization-defined] for system operations organizational command and control.
5
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the alternate path is physically or logically diverse from the primary, including carrier and route diversity · Document repository
- Test records of command and control conducted over the alternate path · Document repository
governing documentDocuments that govern the control
- The defined alternate communications paths established for system operations command and control · Document repository
- Activation procedure naming who switches and under what conditions · Policy repository / GRC workspace
- Evidence the alternate path is protected to the same standard as the primary · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Alternate path sharing the same physical duct, provider or exchange as the primary
- Path exists but is never used, so credentials and configurations on it have expired
- Alternate path protected less strongly than the primary, making it the attractive target
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-46 Cross Domain Policy Enforcement. Implement a policy enforcement mechanism [organization-defined] between the physical and/or network interfaces for the connecting security domains · SC-48 Sensor Relocation. Relocate [organization-defined] to [organization-defined] under the following conditions or circumstances: [organization-defined]