Separation of System and User Functionality
LOW ✓ MODERATE ✓ HIGHRequirements NIST SOURCE
Separate user functionality, including user interface services, from system management functionality.
Discussion (NIST Supplemental Guidance)
System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in SA-8 , including SA-8(1), SA-8(3), SA-8(4), SA-8(10), SA-8(12), SA-8(13), SA-8(14) , and SA-8(18).
Enhancements NIST SOURCE
SC-2(1) Interfaces for Non-privileged Users LOW MODERATE HIGH
Prevent the presentation of system management functionality at interfaces to non-privileged users.
Discussion
Preventing the presentation of system management functionality at interfaces to non-privileged users ensures that system administration options, including administrator privileges, are not available to the general user population. Restricting user access also prohibits the use of the grey-out option commonly used to eliminate accessibility to such information. One potential solution is to withhold system administration options until users establish sessions with administrator privileges.
SC-2(2) Disassociability LOW MODERATE HIGH
Store state information from applications and software separately.
Discussion
If a system is compromised, storing applications and software separately from state information about users’ interactions with an application may better protect individuals’ privacy.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SC-2 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- user functionality, including user interface services, is separated from system management functionality.
Examine
[SELECT FROM: System and communications protection policy; procedures addressing application partitioning; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developer].
Test
[SELECT FROM: Separation of user functionality from system management functionality].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SC-2. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and communications protection policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Separation of user functionality from system management functionality
Other Records
- procedures addressing application partitioning
- system audit records
- other relevant documents or records