PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

Threats Addressed:

Info icon.

Subcategory is new to this version of the framework and incorporates the following items from the previous version: PR.AC-3: Remote access is managed, PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation), PR.DS-7: The development and testing environment(s) are separate from the production environment, PR.PT-4: Communications and control networks are protected.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

3rd: 3rd Party Risk

Ex1: Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments

Ex2: Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks

Ex3: Implement zero trust architectures to restrict network access to each resource to the minimum necessary

Ex4: Check the cyber health of endpoints before allowing them to access and use production resources

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

AC-3: Access Enforcement

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

AC-4: Information Flow Enforcement

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].

SC-5: Denial-of-service Protection

[Assignment: protect against, limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events] ; and Employ the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event].

SC-7: Boundary Protection

Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; Implement subnetworks for publicly accessible system components that are [Assignment: physically, logically] separated from internal organizational networks; and Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged…

NIST SP 800-171 Revision 3.0

03.01.02: Access Enforcement

Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.

03.13.01: Boundary Protection

Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. Connect to external systems only through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational…

Cloud Controls Matrix v4.0

DCS-12: Cabling Security

Define, implement and evaluate processes, procedures and technical measures that ensure a risk-based protection of power and telecommunication cables from a threat of interception, interference or damage at all facilities, offices and rooms.

DSP-10: Sensitive Data Transfer

Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.

IVS-03: Network Security

Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.

IVS-06: Segmentation and Segregation

Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.

IVS-09: Network Defense

Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.

UEM-05: Endpoint Management

Define, implement and evaluate processes, procedures and technical measures to enforce policies and controls for all endpoints permitted to access systems and/or store, transmit, or process organizational data.

UEM-14: Third-Party Endpoint Security Posture

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.

Critical Security Controls Version 8.1