ComplianceNIST 800-53 control

NIST-SC-38 Operations Security

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-38
ATT&CK techniques mitigated
2

Control statement

Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [Assignment: operations security controls].

Discussion

Operations security (OPSEC) is a systematic process by which potential adversaries can be denied information about the capabilities and intentions of organizations by identifying, controlling, and protecting generally unclassified information that specifically relates to the planning and execution of sensitive organizational activities. The OPSEC process involves five steps: identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risks, and the application of appropriate countermeasures. OPSEC controls are applied to organizational systems and the environments in which those systems operate. OPSEC controls protect the confidentiality of information, including limiting the sharing of information with suppliers, potential suppliers, and other non-organizational elements and individuals. Information critical to organizational mission and business functions includes user identities, element uses, suppliers, supply chain processes, functional requirements, security requirements, system design specifications, testing and evaluation protocols, and security control implementation details.

ATT&CK mappings (CTID)

• T1005 Data from Local System • T1025 Data from Removable Media

Related

Mitigates · MITRE ATT&CK (2)

  • T1005 Data from Local System technique
  • T1025 Data from Removable Media technique

Related control · Compliance (11)

  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-PL-1 Policy and Procedures NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
  • NIST-PM-9 Risk Management Strategy NIST 800-53 control
  • NIST-RA-2 Security Categorization NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-7 Supply Chain Operations Security NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (13)

  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
  • NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
  • NIST-PM-9 Risk Management Strategy NIST 800-53 control
  • NIST-RA-2 Security Categorization NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-7(9) Restrict Threatening Outgoing Communications Traffic NIST 800-53 enhancement
  • NIST-SI-8 Spam Protection NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-7 Supply Chain Operations Security NIST 800-53 control