PrM Processor The system shall provide operator visibility SG.SI-4 FR28 Monitoring and appropriate alerting for <Role's host's> processor activity, including available CPU capacity and processor use per <Role>. PSI Protection of The system shall protect all sensitive SG.SC-26, FS1, FS2, Security Information information involved in the execution of SG.AU-9 FS3 security functions from unauthorized access or action. Sensitive information shall at a minimum include: User Account Information User and Device Privileges Cryptographic Material (including keys, hashes, and certificates) Non-Cryptographic Credential Data (including biologically-based credentials) Audit Records Configuration System Backups Access to all sensitive information be controlled in accordance with Least Privilege (LP - defined herein). Storage of all sensitive information shall be controlled in accordance with Configuration File and Sensitive Data Integrity Check (CFSD) and Software and Firmware Authenticity (SFA). All cryptographic material shall be stored and managed in accordance with NIST 800-57 and FIPS Additionally, storage of User Account Information and Non-Cryptographic Credential Data shall be encrypted using a FIPS 140-2 approved cryptographic module. Transmission of all sensitive information shall be controlled in accordance with Communications Confidentiality (CCf) and Communications Integrity (CI). PW Process Whitelisting <Role> shall be configured with a process FR2, FR26 white list to restrict processes to only those necessary to support the <role's> function. QSE Quality of Service The network shall process all traffic in SG.SC-6 FC1 Enforcement accordance with the QoS resource reservation identifier (i.e., IEEE 802.1Q Priority Tag).
PrM Processor Monitoring The system shall provide operator visibility and appropriate alerting for <Role's host's> processor activity, including available CPU capacity and processor use per <Role>. SG.SI-4 FR28 PSI Protection of Security Information The system shall protect all sensitive information involved in the execution of security functions from unauthorized access or action. Sensitive information shall at a minimum include: User Account Information User and Device Privileges Cryptographic Material (including keys, hashes, and certificates) Non-Cryptographic Credential Data (including biologically-based credentials) Audit Records Configuration System Backups Access to all sensitive information be controlled in accordance with Least Privilege (LP - defined herein). Storage of all sensitive information shall be controlled in accordance with Configuration File and Sensitive Data Integrity Check (CFSD) and Software and Firmware Authenticity (SFA). All cryptographic material shall be stored and managed in accordance with NIST 800-57 and FIPS Additionally, storage of User Account Information and Non-Cryptographic Credential Data shall be encrypted using a FIPS 140-2 approved cryptographic module. Transmission of all sensitive information shall be controlled in accordance with Communications Confidentiality (CCf) and Communications Integrity (CI). SG.SC-26, SG.AU-9 FS1, FS2, FS3 PW Process Whitelisting <Role> shall be configured with a process white list to restrict processes to only those necessary to support the <role's> function. FR2, FR26 QSE Quality of Service Enforcement The network shall process all traffic in accordance with the QoS resource reservation identifier (i.e., IEEE 802.1Q Priority Tag). SG.SC-6 FC1
SA%20Security%20Profile%20-%20v0_15%20-%2020120930.docx