SC-7(28): Connections to Public Networks
Control Family:
Parent Control:
Threats Addressed:
Baselines:
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Control is new to this version of the control set and incorporates the following item from the previous version: CA-3(4): Connections To Public Networks.
Control Statement
Prohibit the direct connection of [Assignment: organization-defined system] to a public network.
Supplemental Guidance
A direct connection is a dedicated physical or virtual connection between two or more systems. A public network is a network accessible to the public, including the Internet and organizational extranets with public access.
OT Discussion
Organizations consider the need for a direct connection to a public network for each OT system, including potential benefits, additional threat vectors, and potential adverse impacts that are specifically relevant to the type of public access that connection introduces.
OT Baseline Rationale
Rationale for adding to Low, Mod, High baselines: Access to OT should be restricted to the individuals required for operation. A connection made from the OT directly to a public network has limited applicability in OT environments but significant potential risk.