1. Home
  2. FedRAMP
  3. SC-28

BRACKETOLOGY | FEDRAMP

SC-28: PLATFORM-INDEPENDENT APPLICATIONS

  • FedRAMP Baseline Membership SC-28:
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The information system protects the [Selection (one or more): confidentiality; integrity] of [Assignment: organization-defined information at rest].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

The information system protects the confidentiality AND integrity of organization-defined information at rest.

FedRAMP GUIDANCE:

The organization supports the capability to use cryptographic mechanisms to protect information at rest.

The information system protects the confidentiality AND integrity of organization-defined information at rest.

FedRAMP GUIDANCE:

The organization supports the capability to use cryptographic mechanisms to protect information at rest.


SUPPLEMENTAL GUIDANCE

This control addresses the confidentiality and integrity of information at rest and covers user information and system information. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems. System-related information requiring protection includes, for example, configurations or rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing Write-Once-Read-Many (WORM) technologies. Organizations may also employ other security controls including, for example, secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved and/or continuous monitoring to identify malicious code at rest.

CONTROL ENHANCEMENTS

SC-28 (1) PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC PROTECTION
  • FedRAMP Baseline Membership SC-28 (1):
  • MODERATE
  • HIGH

The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined information] on [Assignment: organization-defined information system components].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

There are no FedRAMP-specific requirements if this control is used for a MODERATE Impact system.

The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information on all information system components storing customer data deemed sensitive.

Supplemental Guidance:

Selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of organizational information. The strength of mechanism is commensurate with the security category and/or classification of the information. This control enhancement applies to significant concentrations of digital media in organizational areas designated for media storage and also to limited quantities of media generally associated with information system components in operational environments (e.g., portable storage devices, mobile devices). Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). Organizations employing cryptographic mechanisms to protect information at rest also consider cryptographic key management solutions.

RELATED CONTROLS: SC-28 (1)

SC-28 (2) PROTECTION OF INFORMATION AT REST | OFF-LINE STORAGE

The organization removes from online storage and stores off-line in a secure location [Assignment: organization-defined information].

Supplemental Guidance:

Removing organizational information from online information system storage to off-line storage eliminates the possibility of individuals gaining unauthorized access to the information through a network. Therefore, organizations may choose to move information to off-line storage in lieu of protecting such information in online storage.

REFERENCES:

  • NIST Special Publication 800-111
  • NIST Special Publication 800-56
  • NIST Special Publication 800-57