{"data":{"id":"SC-32","name":"System Partitioning","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Partition the system into [Assignment: organization-defined system components] residing in separate [Selection (one): physical; logical] domains or environments based on [Assignment: organization-defined circumstances for physical or logical separation of components].","supplemental_guidance":"System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Security categorization can guide the selection of candidates for domain partitioning. Managed interfaces restrict or prohibit network access and information flow among partitioned system components.","enhancements":[{"id":"SC-32(01)","name":"Separate Physical Domains for Privileged Functions","statement":"Partition privileged functions into separate physical domains.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"SC-32","name":"System Partitioning","description":"Partition the system into [Assignment: organization-defined system components] residing in separate [Selection (one): physical; logical] domains or environments based on [Assignment: organization-defined circumstances for physical or logical separation of components].","discussion":"System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Security categorization can guide the selection of candidates for domain partitioning. Managed interfaces restrict or prohibit network access and information flow among partitioned system components.","related_controls":["AC-04","AC-06","SA-08","SC-02","SC-03","SC-07","SC-36"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"No significant changes from Rev 4."}},"compliance_mappings":{"iso_27001_2022":["A.8.22","A.8.27","A.8.31"],"iso_27002_2022":["8.22","8.27","8.31"],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["PR.DS-01","PR.DS-10","PR.IR-01"],"cis_controls_v8":["CIS 3.12","CIS 4.12","CIS 12.2","CIS 12.8","CIS 16.8"],"soc2_tsc":[],"finos_ccc":["CCC-C09"],"iso_42001_2023":[],"iec_62443":["3-3 SR 5.1"],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["NET.1.1"],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":["8.22","8.27","8.31"],"rbi_csf":["Annex1.4"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":["TME1.7.3"],"mlps_2":["8.1.2.1","8.2"],"dnb_good_practice":["DNB.10.3"],"cra":[],"swift_cscf":["SWIFT.1.1"],"cbb_tm":["TM-8"],"nca_ecc":["2-3","2-5","5-1"],"qatar_nia":["CS"],"sama_csf":["3.3"],"uae_ia":["T8"],"bom_ctrm":["3.2"],"bot_cyber":["Ch2.4"],"ffiec_is":["II.C.2"],"hipaa_sr":["§164.308(a)(4)(ii)(A)","§164.314(b)(2)"],"iosco_cyber":["PROT-2"],"sebi_cscrf":["PR.NS"],"nerc_cip":[],"nrc_73_54":["73.54(c)(1)","73.54(c)(2)","RG5.71-A-SC"],"tsa_psd":["SD-2 Sec A","SD-2 Sec F"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["ARCHITECTURE"],"api_1164":["Sec 5"],"awia":["AWWA Sec 4"],"iaea_nss":["Sec 5.1"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":["13.1"],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":["NDG-9.2"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1590.002","name":"DNS","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"System partitioning across separate physical and logical domains limits DNS reconnaissance effectiveness by reducing the DNS information exposed from any single partition, preventing adversaries from mapping the complete infrastructure."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings from framework-coverage data 2026-10-03: nist_csf_2 PR.DS-01, PR.DS-10 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-017","SP-029","SP-034"]}}