Randomness
LOW MODERATE HIGHRequirements NIST SOURCE
Employ [techniques] to introduce randomness into organizational operations and assets.
Discussion (NIST Supplemental Guidance)
Randomness introduces increased levels of uncertainty for adversaries regarding the actions that organizations take to defend their systems against attacks. Such actions may impede the ability of adversaries to correctly target information resources of organizations that support critical missions or business functions. Uncertainty may also cause adversaries to hesitate before initiating or continuing attacks. Misdirection techniques that involve randomness include performing certain routine actions at different times of day, employing different information technologies, using different suppliers, and rotating roles and responsibilities of organizational personnel.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SC-30(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- techniques employed to introduce randomness into organizational operations and assets are defined;
- <SC-30(02)_ODP techniques> are employed to introduce randomness into organizational operations and assets.
Examine
[SELECT FROM: System and communications protection policy; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; system architecture; list of techniques to be employed to introduce randomness into organizational operations and assets; system audit records; system security plan; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with the responsibility to implement concealment and misdirection techniques for systems].
Test
[SELECT FROM: Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SC-30(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and communications protection policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
- system architecture
Testing
- Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique
Other Records
- procedures addressing concealment and misdirection techniques for the system
- list of techniques to be employed to introduce randomness into organizational operations and assets
- system audit records
- other relevant documents or records