1. Home
  2. FedRAMP
  3. SC-39

BRACKETOLOGY | FEDRAMP

SC-39: PROCESS ISOLATION

  • FedRAMP Baseline Membership SC-39:
  • LOW
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The information system maintains a separate execution domain for each executing process.

SUPPLEMENTAL GUIDANCE

Information systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each information system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. This capability is available in most commercial operating systems that employ multi-state processor technologies.

CONTROL ENHANCEMENTS

SC-39 (1) PROCESS ISOLATION | HARDWARE SEPARATION

The information system implements underlying hardware separation mechanisms to facilitate process separation.

Supplemental Guidance:

Hardware-based separation of information system processes is generally less susceptible to compromise than software-based separation, thus providing greater assurance that the separation will be enforced. Underlying hardware separation mechanisms include, for example, hardware memory management.

SC-39 (2) PROCESS ISOLATION | THREAD ISOLATION

The information system maintains a separate execution domain for each thread in [Assignment: organization-defined multi-threaded processing].

Supplemental Guidance: NONE

REFERENCES:

  • NO REFERENCES