{"data":{"id":"SC-03","name":"Security Function Isolation","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Isolate security functions from nonsecurity functions.","supplemental_guidance":"Security functions are isolated from nonsecurity functions by means of an isolation boundary implemented within a system via partitions and domains. The isolation boundary controls access to and protects the integrity of the hardware, software, and firmware that perform system security functions. Systems implement code separation in many ways, such as through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that protect the code on disk and address space protections that protect executing code. Systems can restrict access to security functions using access control mechanisms and by implementing least privilege capabilities. While the ideal is for all code within the defined security function isolation boundary to only contain security-relevant code, it is sometimes necessary to include nonsecurity functions as an exception. The isolation of security functions from nonsecurity functions can be achieved by applying the systems security engineering design principles in SA-08, including SA-08(01), SA-08(03), SA-08(04), SA-08(10), SA-08(12), SA-08(13), SA-08(14), and SA-08(18).","enhancements":[{"id":"SC-03(01)","name":"Hardware Separation","statement":"Employ hardware separation mechanisms to implement security function isolation.","baselines":[]},{"id":"SC-03(02)","name":"Access and Flow Control Functions","statement":"Isolate security functions enforcing access and information flow control from nonsecurity functions and from other security functions.","baselines":[]},{"id":"SC-03(03)","name":"Minimize Nonsecurity Functionality","statement":"Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.","baselines":[]},{"id":"SC-03(04)","name":"Module Coupling and Cohesiveness","statement":"Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.","baselines":[]},{"id":"SC-03(05)","name":"Layered Structures","statement":"Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SC-03","name":"Security Function Isolation","description":"Isolate security functions from nonsecurity functions.","discussion":"Security functions are isolated from nonsecurity functions by means of an isolation boundary implemented within a system via partitions and domains. The isolation boundary controls access to and protects the integrity of the hardware, software, and firmware that perform system security functions. Systems implement code separation in many ways, such as through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that protect the code on disk and address space protections that protect executing code. Systems can restrict access to security functions using access control mechanisms and by implementing least privilege capabilities. While the ideal is for all code within the defined security function isolation boundary to only contain security-relevant code, it is sometimes necessary to include nonsecurity functions as an exception. The isolation of security functions from nonsecurity functions can be achieved by applying the systems security engineering design principles in SA-08, including SA-08(01), SA-08(03), SA-08(04), SA-08(10), SA-08(12), SA-08(13), SA-08(14), and SA-08(18).","related_controls":["AC-03","AC-06","AC-25","CM-02","CM-04","SA-04","SA-05","SA-08","SA-15","SA-17","SC-02","SC-07","SC-32","SC-39","SI-16"],"baseline_low":false,"baseline_moderate":false,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":[],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.23","SecNumCloud.14.1"],"osfi_b13":["B-13.2.2","B-13.3.2"],"finma_circular":["IV.C(62)","IV.C(63)"],"gdpr":["Art.32(1)(a)","Art.32(1)(b)"],"dora":["Art.9(4)(a)"],"bio2":[],"rbi_csf":["Annex1.6"],"fisc":["FISC.T3","FISC.T14"],"lgpd_bcb":[],"hkma_tme1":["TME1.7.3"],"mlps_2":[],"dnb_good_practice":[],"cra":["CRA.I.2k"],"swift_cscf":[],"cbb_tm":["TM-8"],"nca_ecc":["2-3"],"qatar_nia":["CS"],"bog_cisd":["CISD-VI"],"bcbs_239":["Principle 2"],"bot_cyber":["Ch2.4"],"cpmi_pfmi":["CG.PR"],"ecb_croe":["CROE.2.3.5"],"ffiec_is":["II.C.2","II.C.15(a)"],"hipaa_sr":["§164.308(a)(4)(ii)(A)"],"iosco_cyber":["PROT-2"],"nydfs_500":["500.8"],"cmmc_2":["SC"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":["FIPS 140-3 §7.3"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.6"],"owasp_masvs_v2":[],"csa_ccm_v4":["IVS-06"],"csa_aicm":["I&S-06"],"ccss_v9":[],"mica":[],"basel_sco60":["SCO60.64"],"bssc":[],"sec_custody_digital":["SEC-CD-04"],"dpdpa":[]},"attack_techniques":[{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation ensures that WMI execution occurs within controlled domains, preventing adversaries from leveraging WMI to cross security boundaries and tamper with security-enforcement mechanisms."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation separates security-critical processes from application processes, limiting the impact of privilege-escalation exploits by ensuring they cannot directly compromise security-enforcement functions."},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation ensures that drive-by compromise of application processes cannot directly impact security functions, as browser sandboxes and security services operate in separate, protected execution domains."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation protects security-enforcement mechanisms from exploitation of public-facing applications by maintaining security functions in domains inaccessible from compromised web-application processes."},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation contains client-execution exploits by ensuring that compromised application processes operate in domains separated from security controls, preventing exploitation from disabling defensive mechanisms."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation limits the impact of remote-service exploitation by ensuring that security functions run in protected domains inaccessible from compromised application services."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation directly addresses exploitation for defense evasion by maintaining security functions in isolated execution domains that cannot be disabled or modified through application-level vulnerabilities."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation protects credential-management services by separating authentication and authorization functions into protected domains inaccessible from exploited application processes."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation prevents inter-process communication abuse from reaching security functions by maintaining security processes in protected domains that restrict incoming IPC from untrusted sources."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation protects network device security configurations by separating management-plane functions from data-plane processes, preventing configuration extraction through compromised forwarding processes."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation directly addresses container escape by maintaining host security functions in protected domains separate from container execution environments, limiting escape impact."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation with Credential Guard moves LSASS credential operations to a virtualization-based security enclave, protecting NTLM hashes and Kerberos tickets from extraction even by kernel-level attackers."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation restricts DCOM-based lateral movement by maintaining security boundaries between COM execution domains, preventing unauthorized remote COM instantiation from accessing protected resources."},{"id":"T1134.005","name":"SID-History Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation protects SID-history processing by isolating authentication-token creation within protected security functions, preventing adversaries from injecting unauthorized SIDs into access tokens."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation restricts COM abuse by maintaining security boundaries around COM server processes, preventing malicious COM clients from executing code in protected security-function domains."},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation limits DDE exploitation impact by ensuring that code execution through Dynamic Data Exchange cannot reach or modify security functions operating in isolated execution domains."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation separates SNMP management functions from forwarding-plane operations, preventing compromised data-plane processes from accessing device configuration through management-interface exploitation."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Security function isolation protects network device configuration by isolating management-plane functions, ensuring that configuration data cannot be extracted through compromised application or forwarding processes."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: baselines LMH to --H, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-011","SP-017"]}}