PE-19—Information Leakage
IL6
>Control Description
Protect the system from information leakage due to electromagnetic signals emanations.
>DoD Impact Level Requirements
No specific parameter values or requirements for this impact level.
>Discussion
Information leakage is the intentional or unintentional release of data or information to an untrusted environment from electromagnetic signals emanations. The security categories or classifications of systems (with respect to confidentiality), organizational security policies, and risk tolerance guide the selection of controls employed to protect systems against information leakage due to electromagnetic signals emanations.
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern information leakage prevention and site/facility location with respect to sensitive information?
- •How does the organization assess electromagnetic, acoustic, and other emanation risks?
- •What is the process for evaluating information system placement within the facility to minimize leakage?
- •How are emanation risks incorporated into system security planning?
- •What governance exists for periodically assessing information leakage risks?
Technical Implementation:
- •What emanation control measures are implemented (shielding, TEMPEST, white noise)?
- •How are information systems positioned to minimize electromagnetic leakage?
- •What equipment or technologies detect or prevent emanations?
- •How are wireless and RF transmissions controlled or shielded?
- •What acoustic protection measures are implemented for sensitive discussions?
Evidence & Documentation:
- •Provide information leakage risk assessment documentation.
- •Provide evidence of emanation protection measures (shielding, TEMPEST, etc.).
- •Provide documentation of information system placement decisions to minimize leakage.
- •Provide records of emanation testing or surveys if conducted.
Ask AI
Configure your API key to use AI features.