{"data":{"id":"SC-02","name":"Separation of System and User Functionality","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Separate user functionality, including user interface services, from system management functionality.","supplemental_guidance":"System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in SA-08, including SA-08(01), SA-08(03), SA-08(04), SA-08(10), SA-08(12), SA-08(13), SA-08(14), and SA-08(18).","enhancements":[{"id":"SC-02(01)","name":"Interfaces for Non-privileged Users","statement":"Prevent the presentation of system management functionality at interfaces to non-privileged users.","baselines":[]},{"id":"SC-02(02)","name":"Disassociability","statement":"Store state information from applications and software separately.","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SC-02","name":"Separation of System and User Functionality","description":"Separate user functionality, including user interface services, from system management functionality.","discussion":"System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in SA-08, including SA-08(01), SA-08(03), SA-08(04), SA-08(10), SA-08(12), SA-08(13), SA-08(14), and SA-08(18).","related_controls":["AC-06","SA-04","SA-08","SC-03","SC-07","SC-22","SC-32","SC-39"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":[],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.23","SecNumCloud.14.1"],"osfi_b13":["B-13.2.2","B-13.3.2"],"finma_circular":["IV.C(62)","IV.C(63)"],"gdpr":["Art.5(1)(f)","Art.32(1)(b)"],"dora":["Art.9(4)(a)"],"bio2":[],"rbi_csf":["Annex1.6"],"fisc":["FISC.T3","FISC.T14"],"lgpd_bcb":[],"hkma_tme1":["TME1.7.3"],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"cbb_tm":["TM-8"],"nca_ecc":["2-3"],"qatar_nia":["CS"],"bog_cisd":["CISD-VI"],"bcbs_239":["Principle 2"],"bot_cyber":["Ch2.4"],"cpmi_pfmi":["CG.PR"],"ecb_croe":["CROE.2.3.5"],"ffiec_is":["II.C.2","II.C.15(b)"],"hipaa_sr":["§164.308(a)(4)(ii)(A)"],"iosco_cyber":["PROT-2"],"cmmc_2":["SC"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":["Order 887"],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":["P-IT.3"],"solvency_ii":["EIOPA-ICT-4.6"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":["SCO60.64"],"bssc":[],"sec_custody_digital":["SEC-CD-04"],"dpdpa":[]},"attack_techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separating user-facing functionality from management services through application partitioning limits the impact of privilege escalation exploits by ensuring compromised user-tier components cannot directly access management-tier resources."},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Application partitioning that isolates public web interfaces from backend management systems contains drive-by compromise impact, preventing adversary pivot from compromised user-facing components to administrative services."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Separating public-facing application interfaces from internal management functionality ensures that exploitation of user-accessible components does not grant direct access to administrative systems or databases."},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Application partitioning that isolates user interface processing from management services limits the impact of client-side exploitation by preventing compromised user-tier components from accessing privileged management functions."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separating user functionality from system management through physical or logical partitioning limits lateral movement from exploited user-facing services to management infrastructure on separate network segments."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Application partitioning ensures that defense evasion exploits targeting user-facing components cannot directly compromise management-tier security controls operating on separate, isolated infrastructure."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separating authentication management from user interface services ensures that credential access exploits targeting user-facing components cannot directly reach credential stores on management-tier systems."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Application partitioning that separates containerized user workloads from container management infrastructure limits the impact of container escape by isolating user-tier containers from management-tier orchestration components."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-002","SP-011"]}}