1Overview
SC.L2-3.13.4 addresses information leaking between users through shared system resources. It requires that unauthorized and unintended information transfer via shared system resources be prevented, so that data left in memory, storage, or other shared resources by one process or user is not exposed to another. It is a one-point requirement and may be deferred on a plan of action.
Systems share resources, memory, storage, buffers, among processes and users, and if those resources are not cleared or isolated between uses, information from one can leak to the next. This control requires preventing that unauthorized and unintended transfer, so that a shared resource does not carry one user's data to another. It is typically addressed by the operating system and platform through resource isolation and clearing, but the organization is responsible for ensuring the property holds. The single assessment objective is that this transfer is prevented.
Prevent unauthorized and unintended information transfer via shared system resources.
The requirement is to prevent information transfer, both unauthorized and unintended, through shared system resources. In practice this means the platform clears or isolates shared resources such as memory and storage between uses, so residual data does not pass from one process or user to another. Modern operating systems provide much of this, and the organization ensures the systems in scope actually enforce it.
2The Assessment Objective
NIST SP 800-171A frames 3.13.4 as a single objective: prevent unauthorized and unintended transfer via shared resources.
Unauthorized and unintended information transfer via shared system resources is prevented. Shared resources do not leak data between users or processes.
The single objective is preventing the transfer. The common gap is systems that do not enforce resource isolation, or legacy platforms where clearing is not assured. The assessor looks for evidence that shared resources do not leak information between uses.
3Failure Patterns
The failures are about residual data in shared resources.
Resources not cleared between uses
Where memory or storage is reassigned without clearing, one user's data can appear to the next. Clearing or isolating shared resources prevents the transfer.
Isolation not enforced
Platforms that do not enforce process or user isolation allow shared resources to carry data across boundaries. Enforced isolation closes this.
Legacy systems without the property
Older systems may not assure resource clearing, leaving the transfer possible. Systems in scope have to actually enforce the prevention.
4Ownership
This is an IT and platform-owned control.
| Role | Responsibility for this control |
|---|---|
| IT and system administrator | Ensures systems enforce resource isolation and clearing. Owns the configuration evidence. |
| System architects | Select platforms that provide the isolation property. |
| Security or compliance lead | Confirms the prevention holds on systems in scope. |
5Tooling
The control is delivered largely by the operating system and platform.
| Objective | Tooling | What it provides |
|---|---|---|
| isolate | OS process and memory isolation | Separation of shared resources between users and processes. |
| clear | Resource clearing on reallocation | Residual data removed before reuse. |
The caveat is that the property has to actually hold on the systems in scope, especially any legacy platforms. Assuming modern isolation without confirming it on older systems leaves a gap. The assessor examines whether the transfer is prevented, so the property has to be enforced.
6Evidence
The satisfied version of 3.13.4 shows shared resources that do not leak.
| Evidence | What it demonstrates |
|---|---|
| Platform isolation configuration | The objective. Shared resources isolated and cleared. |
| System documentation | The objective. The prevention property on systems in scope. |
The evidence should show that systems in scope enforce isolation and clearing of shared resources so information does not transfer between uses. The platform configuration and system documentation are the clearest demonstration of the control.
A shared resource should not carry data between users
Residual data in memory or storage can leak from one user to the next unless the platform prevents it, so this control asks that unauthorized and unintended transfer via shared resources be stopped. Confirming that property on the systems in scope is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.13.4. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objective 3.13.4. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov