Navigate

SC-43

SC-43: Usage Restrictions

a: Establish usage restrictions and implementation guidelines for the following system components: [the components for which usage restrictions and implementation guidance are to be established are defined;] ; and

b: Authorize, monitor, and control the use of such components within the system.

Supplemental

Usage restrictions apply to all system components including but not limited to mobile code, mobile devices, wireless access, and wired and wireless peripheral components (e.g., copiers, printers, scanners, optical devices, and other similar technologies). The usage restrictions and implementation guidelines are based on the potential for system components to cause damage to the system and help to ensure that only authorized system use occurs.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
CDS - Access, CDS - Multilevel, CDS - Transfer, DAF Baseline, NC3

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-43.

Control	Description
AC-18	a: Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b: Authorize each type of wireless access to the system prior to allowing such connections.
AC-19	a: Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b: Authorize the connection of mobile devices to organizational systems.
CM-6	a: Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [common secure configurations to establish and document configuration settings for components employed within the system are defined;]; b: Implement the configuration settings; c: Identify, document, and approve any deviations from established configuration settings for [system components for which approval of deviations is needed are defined;] based on [operational requirements necessitating approval of deviations are defined;] ; and d: Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.
SC-7	a: Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b: Implement subnetworks for publicly accessible system components that are [one of "physically"/"logically"] separated from internal organizational networks; and c: Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
SC-18	a: Define acceptable and unacceptable mobile code and mobile code technologies; and b: Authorize, monitor, and control the use of mobile code within the system.

Enhancements

The controls below (if any) add on to the requirements of SC-43.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-43.

CCI	Definition
CCI-001212	Defines system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.
CCI-002559	Defines the system components for which usage restrictions and implementation guidance are to be established.
CCI-002560	Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously.
CCI-002561	Authorize the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.
CCI-002562	Monitor the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.
CCI-002563	Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.