Navigate

SC-36

SC-36: Distributed Processing And Storage

The organization distributes [Assignment: organization-defined processing and storage] across multiple physical locations.

Supplemental

Distributing processing and storage across multiple physical locations provides some degree of redundancy or overlap for organizations, and therefore increases the work factor of adversaries to adversely impact organizational operations, assets, and individuals. This control does not assume a single primary processing or storage location, and thus allows for parallel processing and storage.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-36.

Control	Description
CP-6	The organization: CP-6a.: Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and CP-6b.: Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CP-7	The organization: CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.

Control

Description

CP-6

The organization:

CP-6a.: Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and

CP-6b.: Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.

CP-7

The organization:

CP-7a.: Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable;

CP-7b.: Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

CP-7c.: Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.

Enhancements

The controls below (if any) add on to the requirements of SC-36.

Control	Description
SC-36 (1)	The organization employs polling techniques to identify potential faults, errors, or compromises to [Assignment: organization-defined distributed processing and storage components].

Related CCIs

The CCIs below are tied to SC-36.

CCI	Definition
CCI-002513	The organization defines the processing that is to be distributed across multiple physical locations.
CCI-002514	The organization defines the storage that is to be distributed across multiple physical locations.
CCI-002515	The organization distributes organization-defined processing across multiple physical locations.
CCI-002516	The organization distributes organization-defined storage across multiple physical locations.