{"data":{"id":"SC-46","name":"Cross Domain Policy Enforcement","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Implement a policy enforcement mechanism [Selection (one): physically; logically] between the physical and/or network interfaces for the connecting security domains.","supplemental_guidance":"For logical policy enforcement mechanisms, organizations avoid creating a logical path between interfaces to prevent the ability to bypass the policy enforcement mechanism. For physical policy enforcement mechanisms, the robustness of physical isolation afforded by the physical implementation of policy enforcement to preclude the presence of logical covert channels penetrating the security domain may be needed. Contact ncdsmo@nsa.gov for more information.","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"SC-46","name":"Cross Domain Policy Enforcement","description":"Implement a policy enforcement mechanism [Selection (one): physically; logically] between the physical and/or network interfaces for the connecting security domains.","discussion":"For logical policy enforcement mechanisms, organizations avoid creating a logical path between interfaces to prevent the ability to bypass the policy enforcement mechanism. For physical policy enforcement mechanisms, the robustness of physical isolation afforded by the physical implementation of policy enforcement to preclude the presence of logical covert channels penetrating the security domain may be needed. Contact ncdsmo@nsa.gov for more information.","related_controls":["AC-04","SC-07"],"baseline_low":null,"baseline_moderate":null,"baseline_high":null,"baseline_privacy":null,"new_in_rev5":true,"changes_from_rev4":"New control in Rev 5."}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":["5.14"],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":[],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":["CCC-C09"],"iso_42001_2023":[],"iec_62443":["3-3 SR 5.1","3-3 SR 5.2"],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["NET.1.1"],"anssi":["Hygiene.17","Hygiene.23","SecNumCloud.14.1"],"osfi_b13":[],"finma_circular":["IV.B.d(59)","IV.C(62)"],"gdpr":[],"dora":["Art.9(4)(a)"],"bio2":["5.14"],"rbi_csf":["Annex1.4"],"fisc":["FISC.T3","FISC.T13"],"lgpd_bcb":[],"hkma_tme1":["TME1.7.3"],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"nca_ecc":["2-5","5-1"],"qatar_nia":["CS"],"bom_ctrm":["3.2"],"iosco_cyber":["PROT-2"],"nerc_cip":[],"nrc_73_54":["73.54(c)(2)","RG5.71-A-SC"],"tsa_psd":["SD-2 Sec A"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["ARCHITECTURE"],"api_1164":["Sec 5"],"awia":["AWWA Sec 4"],"iaea_nss":["Sec 5.1"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":["13.1","H.2"],"lloyds_ms":["MS8.9"],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.6"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement blocks network service discovery probes from crossing security domain boundaries, preventing adversaries from enumerating services in higher-classification domains."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policies on alternative protocol channels detect and block data exfiltration attempts that route through DNS, ICMP, or other protocols to cross security domain boundaries."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement restricts software deployment tool access between domains, preventing adversaries from using trusted distribution platforms to push code across security boundaries."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement validates external remote service connections at domain boundaries, preventing adversaries from using VPN or remote access to pivot between security domains."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement prevents unauthorized account creation from propagating across security domains, ensuring adversary-created accounts remain contained within the compromised domain."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement isolates public-facing applications from internal domains, ensuring exploitation of internet-facing services cannot directly access internal security domains."},{"id":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain enforcement validates trusted relationship access at domain boundaries, preventing adversaries from leveraging compromised partner connections to access higher-classification domains."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain boundaries prevent exploitation of remote services from enabling lateral movement between security domains, containing adversary activity within the compromised domain."},{"id":"T1482","name":"Domain Trust Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement blocks domain trust discovery queries from traversing security boundaries, preventing adversaries from mapping trust relationships across classified domains."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement prevents service stop commands from propagating across domain boundaries, containing adversary impact activities within the compromised security domain."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain network inspection and traffic validation detects adversary-in-the-middle techniques at domain boundaries, preventing credential interception between security domains."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement blocks remote session hijacking across security boundaries, preventing adversaries from pivoting between domains through captured RDP or SSH sessions."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain integrity verification ensures data crossing domain boundaries has not been manipulated, detecting adversary modification of stored or transmitted data between security domains."},{"id":"T1622","name":"Debugger Evasion","tactics":["defense-evasion","discovery"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement prevents debugger and analysis tool output from crossing security boundaries, limiting adversary ability to gather security tool information across domains."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement blocks unauthorized RDP connections between security domains, preventing lateral movement via Remote Desktop Protocol across classification boundaries."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain enforcement blocks DCOM traffic at domain boundaries, preventing adversaries from using Distributed COM for remote object instantiation across security domains."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement blocks WinRM traffic between security domains, preventing adversaries from using Windows Remote Management for cross-domain command execution."},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain filtering of symmetric encrypted protocol traffic detects covert exfiltration channels that adversaries route through encrypted connections to cross domain boundaries."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain inspection of asymmetric encrypted protocol traffic detects TLS-based exfiltration channels that adversaries establish to move data across security domain boundaries."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement prevents cloud credential additions from propagating across security domains, containing adversary persistence attempts within the compromised cloud boundary."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain enforcement prevents domain account creation from one security domain from granting access in another, containing adversary-created backdoor accounts within domain boundaries."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain policy enforcement restricts container API access between security domains, preventing adversaries from querying secrets across domain boundaries through container orchestrator APIs."},{"id":"T1557.001","name":"LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain network filtering detects LLMNR/NBT-NS poisoning at domain boundaries, preventing adversary name resolution attacks from intercepting credentials across security domains."},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain DHCP inspection detects rogue DHCP responses at domain boundaries, preventing adversaries from manipulating client network configurations across security domains."},{"id":"T1557.004","name":"Evil Twin","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain wireless network policies detect evil twin access points that bridge security domain boundaries, preventing adversaries from intercepting wireless traffic across classified networks."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain enforcement blocks RDP session hijacking across security boundaries, preventing adversaries from taking over disconnected sessions in higher-classification domains."},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Cross-domain integrity verification validates runtime data at domain transition points, detecting adversary manipulation of in-memory data being processed across security boundaries."}],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":[]}}