Navigate

SC-34(2)

SC-34(2): Integrity Protection / Read-only Media

The organization protects the integrity of information prior to storage on read-only media and controls the media after such information has been recorded onto the media.

Supplemental

Security safeguards prevent the substitution of media into information systems or the reprogramming of programmable read-only media prior to installation into the systems. Security safeguards include, for example, a combination of prevention, detection, and response.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-34(2).

Control	Description
AC-5	The organization: a: Separates [organization-defined duties of individuals]; b: Documents separation of duties of individuals; and c: Defines information system access authorizations to support separation of duties.
CM-3	The organization: a: Determines the types of changes to the information system that are configuration-controlled; b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; c: Documents configuration change decisions associated with the information system; d: Implements approved configuration-controlled changes to the information system; e: Retains records of configuration-controlled changes to the information system for [organization-defined time period]; f: Audits and reviews activities associated with configuration-controlled changes to the information system; and g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].
CM-5	The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
CM-9	The organization develops, documents, and implements a configuration management plan for the information system that: a: Addresses roles, responsibilities, and configuration management processes and procedures; b: Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; c: Defines the configuration items for the information system and places the configuration items under configuration management; and d: Protects the configuration management plan from unauthorized disclosure and modification.
MP-2	The organization restricts access to [organization-defined types of digital and/or non-digital media] to [organization-defined personnel or roles].
MP-4	The organization: a: Physically controls and securely stores [organization-defined types of digital and/or non-digital media] within [organization-defined controlled areas]; and b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5	The organization: a: Protects and controls [organization-defined types of information system media] during transport outside of controlled areas using [organization-defined security safeguards]; b: Maintains accountability for information system media during transport outside of controlled areas; c: Documents activities associated with the transport of information system media; and d: Restricts the activities associated with the transport of information system media to authorized personnel.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SC-28	The information system protects the [one or more of confidentiality/integrity] of [organization-defined information at rest].
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

Enhancements

The controls below (if any) add on to the requirements of SC-34(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-34(2).

CCI	Definition
CCI-001216	Protect the integrity of information prior to storage on read-only media.
CCI-002507	Control read-only media after information has been recorded onto the media.