extracted_sl5_overlay.json

{
  "SC-03": {
    "name": "SECURITY FUNCTION ISOLATION",
    "attributes": {
      "Open Questions": "Unsure what enhancements to select"
    },
    "selected": false
  },
  "SC-03(1)": {
    "name": "Security Function Isolation | Hardware Separation",
    "attributes": {
      "Open Questions": "Unsure of test methods"
    },
    "selected": false
  },
  "SC-06": {
    "name": "RESOURCE AVAILABILITY",
    "attributes": {
      "Open Questions": "Unsure if should select"
    },
    "selected": false
  },
  "SC-07": {
    "name": "BOUNDARY PROTECTION",
    "attributes": {
      "Justification to Select": "Already selected by IL6.",
      "Open Questions": "Unsure what enhancements to select"
    },
    "selected": true
  },
  "SC-11": {
    "name": "TRUSTED PATH",
    "attributes": {
      "Open Questions": "Unsure if should select"
    },
    "selected": false
  },
  "SC-12": {
    "name": "CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT",
    "attributes": {},
    "selected": false
  },
  "SC-12(1)": {
    "name": "Cryptographic Key Establishment and Management | Availability",
    "attributes": {
      "Justification to Select": "Already selected in IL6.​ ​ ​",
      "Test Method": "Examine, Interview",
      "Supplemental Guidance": "Consider where escrow of keys may conflict with cryptographic erasure of data."
    },
    "selected": true
  },
  "SC-12(2)": {
    "name": "Cryptographic Key Establishment and Management | Symmetric Keys",
    "attributes": {
      "Justification to Select": "Already selected by IL6.",
      "Parameter Value(s)": "Certificates issued in accordance with organization-defined requirements ​ ​",
      "Test Method": "Examine, Interview",
      "Open Questions": "Unsure what parameters to select, Unsure of test methods"
    },
    "selected": true
  },
  "SC-16": {
    "name": "TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES",
    "attributes": {
      "Open Questions": "Unsure if should select, and if so what enhancements"
    },
    "selected": false
  },
  "SC-25": {
    "name": "THIN NODES",
    "attributes": {
      "Justification to Select": "Critical actions can be performed by components that are hardened through simplicity by having minimal functionality.",
      "Test Method": "Examine, Interview",
      "Open Questions": "Unsure if should select"
    },
    "selected": true
  },
  "SC-26": {
    "name": "DECOYS",
    "attributes": {
      "Justification to Select": "Decoys or honeypots can be useful for alerting when attackers have breached a layer of defense. RAND SL5 report calls for honeypots.",
      "Test Method": "Examine, Interview",
      "Open Questions": "Unsure if should select"
    },
    "selected": true
  },
  "SC-28": {
    "name": "PROTECTION OF INFORMATION AT REST",
    "attributes": {},
    "selected": false
  },
  "SC-28(2)": {
    "name": "Protection of Information at Rest | Offline Storage",
    "attributes": {
      "Justification to Select": "SL5 requires offline storage of certain data as well as offline data transfer devices. ​ ​",
      "Test Method": "Examine, Interview",
      "Open Questions": "Do we need supplemental guidance about offline storage facilities, should other controls be involved here?"
    },
    "selected": true
  },
  "SC-28(3)": {
    "name": "Protection of Information at Rest | Cryptographic Keys",
    "attributes": {
      "Justification to Select": "Keys should be stored in TPMs.",
      "Parameter Value(s)": "Hardware-protected key store ​ ​",
      "Test Method": "Examine, Interview",
      "Open Questions": "Should we say more here, should other controls be involved?"
    },
    "selected": true
  },
  "SC-29": {
    "name": "HETEROGENEITY",
    "attributes": {
      "Justification to Select": "Useful in certain contexts like defense in depth.",
      "Test Method": "Examine, Interview",
      "Supplemental Guidance": "Heterogeneity should be used in contexts where security is determined by the strongest link rather than the weakest link. For example, if multiple firewalls are used, using different types of firewalls means a vulnerability in one will not compromise the system.",
      "Open Questions": "Unsure if this is a good selection/supplementation."
    },
    "selected": true
  },
  "SC-30": {
    "name": "CONCEALMENT AND MISDIRECTION",
    "attributes": {
      "Open Questions": "Unsure if to select, very open-ended"
    },
    "selected": false
  },
  "SC-31": {
    "name": "COVERT CHANNEL ANALYSIS",
    "attributes": {
      "Justification to Select": "Not selected by IL6, however necessary to prevent exfiltration including of model weights.",
      "Parameter Value(s)": "Storage and timing",
      "Test Method": "Examine, Interview, Test",
      "Open Questions": "Unsure if should select enhancement SC-31(1)"
    },
    "selected": true
  },
  "SC-31(2)": {
    "name": "Covert Channel Analysis | Maximum Bandwidth",
    "attributes": {
      "Justification to Select": "Restricts ability to exfiltrate weights and other large files over covert channels.",
      "Parameter Value(s)": "Storage and timing, based on client",
      "Supplemental Guidance": "Bandwidth limits should be configured per client for all network devices providing access to weight storage. ​ ​",
      "Test Method": "Examine, Interview, Test",
      "Open Questions": "Do we need more detail in the supplemental guidance?"
    },
    "selected": true
  },
  "SC-31(3)": {
    "name": "Covert Channel Analysis | Measure Bandwidth in Operational",
    "attributes": {
      "Justification to Select": "To enforce SC-31(2), detect any suspicious movement of large amounts of data.",
      "Parameter Value(s)": "Any channel providing access to weight storage​ ​ ​",
      "Test Method": "Examine, Interview, Test",
      "Open Questions": "Unsure of parameter value"
    },
    "selected": true
  },
  "SC-32": {
    "name": "SYSTEM PARTITIONING",
    "attributes": {
      "Open Questions": "Unsure if should select, seems related to network separation family"
    },
    "selected": false
  }
}