Navigate

SC-5

SC-5: Denial Of Service Protection

The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or references to sources for such information] by employing [Assignment: organization-defined security safeguards].

Supplemental

A variety of technologies exist to limit, or in some cases, eliminate the effects of denial of service attacks. For example, boundary protection devices can filter certain types of packets to protect information system components on internal organizational networks from being directly affected by denial of service attacks. Employing increased capacity and bandwidth combined with service redundancy may also reduce the susceptibility to denial of service attacks.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-5.

Control	Description
SC-6	The information system protects the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more); priority; quota; [Assignment: organization-defined security safeguards]].
SC-7	The information system: SC-7a.: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; SC-7b.: Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and SC-7c.: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

Control

Description

SC-6

The information system protects the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more); priority; quota; [Assignment: organization-defined security safeguards]].

SC-7

The information system:

SC-7a.: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system;

SC-7b.: Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and

SC-7c.: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

Enhancements

The controls below (if any) add on to the requirements of SC-5.

Control	Description
SC-5 (1)	The information system restricts the ability of individuals to launch [Assignment: organization-defined denial of service attacks] against other information systems.
SC-5 (2)	The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding denial of service attacks.
SC-5 (3)	The organization: SC-5 (3)(a): Employs [Assignment: organization-defined monitoring tools] to detect indicators of denial of service attacks against the information system; and SC-5 (3)(b): Monitors [Assignment: organization-defined information system resources] to determine if sufficient resources exist to prevent effective denial of service attacks.

Related CCIs

The CCIs below are tied to SC-5.

CCI	Definition
CCI-001093	The organization defines the types of denial of service attacks (or provides references to sources of current denial of service attacks) that can be addressed by the information system.
CCI-002385	The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.
CCI-002386	The organization defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.