Navigate

SC-39

SC-39: Process Isolation

The information system maintains a separate execution domain for each executing process.

Supplemental

Information systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each information system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial operating systems that employ multi-state processor technologies.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-39.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-4	The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
SA-4	The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs: SA-4a.: Security functional requirements; SA-4b.: Security strength requirements; SA-4c.: Security assurance requirements; SA-4d.: Security-related documentation requirements; SA-4e.: Requirements for protecting security-related documentation; SA-4f.: Description of the information system development environment and environment in which the system is intended to operate; and SA-4g.: Acceptance criteria.
SA-5	The organization: SA-5a.: Obtains administrator documentation for the information system, system component, or information system service that describes: SA-5a.1.: Secure configuration, installation, and operation of the system, component, or service; SA-5a.2.: Effective use and maintenance of security functions/mechanisms; and SA-5a.3.: Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions; SA-5b.: Obtains user documentation for the information system, system component, or information system service that describes: SA-5b.1.: User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms; SA-5b.2.: Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and SA-5b.3.: User responsibilities in maintaining the security of the system, component, or service; SA-5c.: Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and takes [Assignment: organization-defined actions] in response; SA-5d.: Protects documentation as required, in accordance with the risk management strategy; and SA-5e.: Distributes documentation to [Assignment: organization-defined personnel or roles].
SA-8	The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.
SC-2	The information system separates user functionality (including user interface services) from information system management functionality.
SC-3	The information system isolates security functions from nonsecurity functions.

Enhancements

The controls below (if any) add on to the requirements of SC-39.

Control	Description
SC-39 (1)	The information system implements underlying hardware separation mechanisms to facilitate process separation.
SC-39 (2)	The information system maintains a separate execution domain for each thread in [Assignment: organization-defined multi-threaded processing].

Related CCIs

The CCIs below are tied to SC-39.

CCI	Definition
CCI-002530	The information system maintains a separate execution domain for each executing process.