SC-31(3)—Measure Bandwidth In Operational Environments
>Control Description
Measure the bandwidth of ⚙organization-defined subset of identified covert channels in the operational environment of the system.
>Supplemental Guidance
Measuring covert channel bandwidth in specified operational environments helps organizations determine how much information can be covertly leaked before such leakage adversely affects mission or business functions. Covert channel bandwidth may be significantly different when measured in settings that are independent of the specific environments of operation, including laboratories or system development environments.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern the implementation of measure bandwidth in operational environments?
- •How are system and communications protection requirements defined and maintained?
- •Who is responsible for configuring and maintaining the security controls specified in SC-31(3)?
Technical Implementation:
- •How is measure bandwidth in operational environments technically implemented in your environment?
- •What systems, tools, or configurations enforce this protection requirement?
- •How do you ensure that measure bandwidth in operational environments remains effective as the system evolves?
Evidence & Documentation:
- •What documentation demonstrates the implementation of SC-31(3)?
- •Can you provide configuration evidence or system diagrams showing this protection control?
- •What logs or monitoring data verify that this control is functioning correctly?
Ask AI
Configure your API key to use AI features.