sl5_control_catalog.json

{
  "metadata": {
    "title": "SL5 Security Controls",
    "version": "SL5 Export",
    "source": "SL5 Control Export PDF"
  },
  "summary": {
    "totalControls": 85,
    "baseControls": 42,
    "enhancements": 43,
    "families": {
      "AC": {
        "name": "ACCESS CONTROL",
        "total": 3,
        "baseControls": 1,
        "enhancements": 2
      },
      "CM": {
        "name": "CONFIGURATION MANAGEMENT",
        "total": 2,
        "baseControls": 1,
        "enhancements": 1
      },
      "CP": {
        "name": "CONTINGENCY PLANNING",
        "total": 7,
        "baseControls": 2,
        "enhancements": 5
      },
      "IA": {
        "name": "IDENTIFICATION AND AUTHENTICATION",
        "total": 2,
        "baseControls": 0,
        "enhancements": 2
      },
      "IR": {
        "name": "INCIDENT RESPONSE",
        "total": 3,
        "baseControls": 2,
        "enhancements": 1
      },
      "IS": {
        "name": "INTERFACE SECURITY",
        "total": 13,
        "baseControls": 6,
        "enhancements": 7
      },
      "NS": {
        "name": "NETWORK SEPARATION",
        "total": 11,
        "baseControls": 8,
        "enhancements": 3
      },
      "PS": {
        "name": "PERSONNEL SECURITY",
        "total": 2,
        "baseControls": 1,
        "enhancements": 1
      },
      "SC": {
        "name": "SYSTEM AND COMMUNICATIONS PROTECTION",
        "total": 26,
        "baseControls": 11,
        "enhancements": 15
      },
      "SI": {
        "name": "SYSTEM AND INFORMATION INTEGRITY",
        "total": 3,
        "baseControls": 0,
        "enhancements": 3
      },
      "ZT": {
        "name": "ZERO TRUST",
        "total": 13,
        "baseControls": 10,
        "enhancements": 3
      }
    }
  },
  "controls": [
    {
      "id": "AC-26",
      "name": "EXPLICIT REVOCATION",
      "family": "AC",
      "isEnhancement": false,
      "baseControlId": "AC-26",
      "enhancementNumber": null,
      "text": "Servers maintain their own key revocation list and receive updates from a centralized source of truth.",
      "discussion": "Explicit revocation has advantages over other systems. There is no need to fail open, and by receiving updates to that list from a highly secured centralized source of truth, there is no need for servers to rely solely on their own understanding of time to expire old certificates.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "AC-26(01)",
      "name": "Explicit Revocation | Avoid Self Revoking",
      "family": "AC",
      "isEnhancement": true,
      "baseControlId": "AC-26",
      "enhancementNumber": 1,
      "text": "Servers reject any update to their key revocation list that revokes its own key.",
      "discussion": "By preventing servers from accepting key revocation list updates that revoke their own key, it is not possible for an attacker to launch an attack that revokes all keys thereby crippling the system. At best, a single attack can revoke half the keys.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "AC-26(01)",
      "name": "Explicit Revocation | Sharded Revocation Lists",
      "family": "AC",
      "isEnhancement": true,
      "baseControlId": "AC-26",
      "enhancementNumber": 1,
      "text": "Servers maintain a multipart revocation list, with a separate emergency revocation list.",
      "discussion": "TODO I don't fully understand sharded revocation lists, or at least am not confident in my understanding",
      "openQuestions": "",
      "relatedControls": [
        "TODO CM - CONFIGURATION MANAGEMENT"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CM-02(08)",
      "name": "Baseline Configuration | Infrastructure as Code",
      "family": "CM",
      "isEnhancement": true,
      "baseControlId": "CM-02",
      "enhancementNumber": 8,
      "text": "A high level declarative or imperative language is used to automate the setting up of services.",
      "discussion": "Infrastructure as code allows the high level states of the system to also be thoroughly encoded.",
      "openQuestions": "Should this also be referenced under CP-09 System Backup. Should this be its own control?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CM-15",
      "name": "STATE ENCODING​",
      "family": "CM",
      "isEnhancement": false,
      "baseControlId": "CM-15",
      "enhancementNumber": null,
      "text": "Thoroughly encode the intended state of systems.",
      "discussion": "The state of a system includes all necessary information needed to perform the desired function. Having a thorough encoding of an intended and safe state of a system, enables confirming when a device has returned to a known working state, detecting intrusions, and recovering to a known safe state.",
      "openQuestions": "Unsure where to put this or what it overlaps with CP - CONTINGENCY PLANNING",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-10(07)",
      "name": "System Recovery and Reconstitution | Routine Resets",
      "family": "CP",
      "isEnhancement": true,
      "baseControlId": "CP-10",
      "enhancementNumber": 7,
      "text": "The system is reset every [Assignment: time interval].",
      "discussion": "As a means to expel potentially unknown attackers, a routine reset may be a useful security hygiene measure. This has the added benefit of exercising the reset procedure to ensure it works when needed.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-10(08)",
      "name": "System Recovery and Reconstitution | Credential Rotation",
      "family": "CP",
      "isEnhancement": true,
      "baseControlId": "CP-10",
      "enhancementNumber": 8,
      "text": "New credentials are used after a system reset.",
      "discussion": "If an attack involves stealing credentials, restoring the network to a known safe state will not stop the attacker from using those same credentials to regain access.",
      "openQuestions": "How do these new credentials get created by or distributed to their owners? Do we want a separate control to require the capability to rotate credentials? Lisa",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-10(09)",
      "name": "System Recovery and Reconstitution | Golden Images",
      "family": "CP",
      "isEnhancement": true,
      "baseControlId": "CP-10",
      "enhancementNumber": 9,
      "text": "Systems are reset by reinstalling all systems from scratch with known good images.",
      "discussion": "Known good images, called “golden images” are used to restore systems to a known safe state.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-10(10)",
      "name": "System Recovery and Reconstitution | Chain of Trust",
      "family": "CP",
      "isEnhancement": true,
      "baseControlId": "CP-10",
      "enhancementNumber": 10,
      "text": "Device resetting relies on a hardware-backed boot verification and chain of trust.",
      "discussion": "If a device has a hardware-backed boot verification that follows a cryptographic chain of trust up through the operating system and applications, then it can be reset to a known good state simply by power cycling, assuming the firmware is not compromised.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-14",
      "name": "QUARANTINE",
      "family": "CP",
      "isEnhancement": false,
      "baseControlId": "CP-14",
      "enhancementNumber": null,
      "text": "When the security posture of a system is compromised, it is disconnected from the rest of the network.",
      "discussion": "Quarantining a compromised system can prevent an attacker from using it to spread to other systems or from accessing or reinfecting it while it is recovered. A single device may be quarantined or entire networks of compromised devices. If necessary, quarantined systems should be clearly identified to prevent accidental reconnection.",
      "openQuestions": "Should we have an enhancement specifying automatic disconnection? This should be partially enabled by zero trust by default. Also see existing NIST control IR-04(05).",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-14(01)",
      "name": "Quarantine | Accelerator Disconnect",
      "family": "CP",
      "isEnhancement": true,
      "baseControlId": "CP-14",
      "enhancementNumber": 1,
      "text": "TODO something about the ability to disconnect from accelerators to isolate from an internal AI attacker.",
      "discussion": "TODO",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "CP-15",
      "name": "MODEL ISOLATION",
      "family": "CP",
      "isEnhancement": false,
      "baseControlId": "CP-15",
      "enhancementNumber": null,
      "text": "TODO something about the ability to reliably and quickly isolate/stop all instances of an AI",
      "discussion": "TODO",
      "openQuestions": "Maybe use NIST IR-04(05) for this? IA - IDENTIFICATION AND AUTHENTICATION",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IA-03(05)",
      "name": "Device Identification and Authentication | Device Inventory",
      "family": "IA",
      "isEnhancement": true,
      "baseControlId": "IA-03",
      "enhancementNumber": 5,
      "text": "a.​ An inventory database shall be maintained of all managed devices. b.​ Only those devices in the inventory should be granted access to resources.",
      "discussion": "Some zero trust implementations like Google’s BeyondCorp maintain a complete inventory of all managed devices or “assets”, which is used to confirm a device is managed before granting access. This has the added benefit of enabling a greater understanding of what is on the network.",
      "openQuestions": "Should this and the following enhancement go under IA-4 Identifier Management?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IA-03(06)",
      "name": "Device Identification and Authentication | No BYOD",
      "family": "IA",
      "isEnhancement": true,
      "baseControlId": "IA-03",
      "enhancementNumber": 6,
      "text": "All devices on the network are owned and issued by the enterprise, employees and collaborators are not permitted to “bring your own device.”",
      "discussion": "Some zero trust implementations allow users such as outside contractors or even employees to use their own devices. This can be convenient but adds additional complications and potential risks.",
      "openQuestions": "",
      "relatedControls": [
        "TODO IR - INCIDENT RESPONSE"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IR-02(04)",
      "name": "Incident Response Testing | Exercise Tooling",
      "family": "IR",
      "isEnhancement": true,
      "baseControlId": "IR-02",
      "enhancementNumber": 4,
      "text": "Tooling used to recover from attacks are deliberately used in a routine manner so they function reliably when needed.",
      "discussion": "If tooling is developed for use in the event of an incident, but is not regularly “exercised”, responders may discover it is broken when they need it. Therefore such tooling should be regularly tested. It is even better if tooling used for normal operation is also capable of handling incidents.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IR-11",
      "name": "BYPASSING REVIEW AND VERSION CONTROL",
      "family": "IR",
      "isEnhancement": false,
      "baseControlId": "IR-11",
      "enhancementNumber": null,
      "text": "a.​ Enable responders to bypass the normal code review and version control process in an emergency. b.​ Actions taken outside the normal review process must retroactively pass it.",
      "discussion": "An attacker who compromises the system may be able to see a fix as it goes through the code review and version control process and preempt it. To avoid this risk, responders may be empowered to make changes manually and directly. However this creates technical debt and the change must pass retroactively be reviewed and redeployed through normal channels.",
      "openQuestions": "What procedures are needed in order to ensure this doesn’t create an attack vector?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IR-12",
      "name": "TECHNICAL DEBT",
      "family": "IR",
      "isEnhancement": false,
      "baseControlId": "IR-12",
      "enhancementNumber": null,
      "text": "a.​ Consider the costs before taking on technical debt during a response. b.​ Record all technical debt taken on. c.​ Set timers to resolve it.",
      "discussion": "Short term mitigations may require creating technical debt to expel an attacker and recover a system. In doing so, responders should consider factors like how quickly these short term fixes can be removed or replaced, what risks does this short term fix create, what systems will become dependent on this short term fix, and will future engineers be able to determine when it is safe or necessary to remove it.",
      "openQuestions": "",
      "relatedControls": [
        "TODO IS - INTERFACE SECURITY"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-02",
      "name": "INTERFACE INVENTORY AND CLASSIFICATION",
      "family": "IS",
      "isEnhancement": false,
      "baseControlId": "IS-02",
      "enhancementNumber": null,
      "text": "The organization: a.​  Maintains a comprehensive inventory of all system interfaces including organization-defined interface types, security classifications, network domains, and AI model interaction capabilities; b.​ Classifies interfaces based on organization-defined security criteria including network domain isolation requirements, data sensitivity, privilege level, model power classification, and nation-state threat exposure; and c.​ Reviews and updates the interface inventory organization-defined frequency and following system changes with verification of air-gap integrity for internal interfaces.",
      "discussion": "Interface inventory and classification provides the foundation for applying appropriate security controls based on interface risk levels and operational requirements. Classification must consider AI-specific factors, network domain boundaries, model capability restrictions, and nation-state threat resistance requirements. Maintaining an inventory also helps identify interfaces that have fallen out of use and now present an unnecessary attack surface.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-02(01)",
      "name": "Interface Inventory and Classification | Automated Discovery",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-02",
      "enhancementNumber": 1,
      "text": "Implement automated discovery mechanisms that continuously identify and catalog all active interfaces across the organization.",
      "discussion": "Automated discovery ensures that new or modified interfaces are immediately identified and properly classified.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-03",
      "name": "INTERFACE AUTHENTICATION",
      "family": "IS",
      "isEnhancement": false,
      "baseControlId": "IS-03",
      "enhancementNumber": null,
      "text": "The organization: a.​ Implements multi-factor, phishing-resistant authentication requirements for organization-defined interface types including customer APIs, administrative interfaces, and high-privilege internal interfaces; b.​ Requires hardware-based authentication tokens for organization-defined critical interface operations and administrative functions; and c.​ Implements device integrity verification and attestation requirements for all devices accessing organization-defined high-security interfaces.",
      "discussion": "Access to sensitive interfaces must be strictly controlled, and access to public interfaces must still be non-anonymous to prevent and detect suspicious or illicit API usage.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-03(01)",
      "name": "Interface Authentication | Dedicated Devices",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-03",
      "enhancementNumber": 1,
      "text": "Require use of dedicated, hardened, simplified devices for organization-defined high-privilege interface operations.",
      "discussion": "Dedicated device requirements implement segregation of duties and reduce attack surface for critical interface operations while preventing multi-use device compromise from affecting high-privilege functions. Requirements for these devices are defined in the TODO control family.",
      "openQuestions": "Guy, does this overlap with one of your controls?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-04",
      "name": "INTERFACE AUTHORIZATION",
      "family": "IS",
      "isEnhancement": false,
      "baseControlId": "IS-04",
      "enhancementNumber": null,
      "text": "Interface access is granted according to the least privilege principle with granular permissions based on operational requirements.",
      "discussion": "Interface authorization and privilege management ensure that interface access follows least privilege principles. These requirements guide Access Control family implementations for interface-specific needs.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-04(01)",
      "name": "Interface Authorization | Privilege Expiration",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-04",
      "enhancementNumber": 1,
      "text": "Implement automatic expiration of interface access privileges with organization-defined frequency requiring active renewal and re-authorization for continued access.",
      "discussion": "Automatic privilege expiration implements least privilege by ensuring that interface access rights are regularly reviewed and renewed rather than persisting indefinitely.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-04(02)",
      "name": "Interface Authorization | Multi-Party Authorization for Critical Interfaces",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-04",
      "enhancementNumber": 2,
      "text": "Require simultaneous authorization from organization-defined multiple independent parties for critical interface operations.",
      "discussion": "Multi-party authorization implements segregation of duties for critical interface operations and prevents single individuals from making unauthorized changes that could compromise system security.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-05",
      "name": "INTERFACE SESSION MANAGEMENT AND TRUST",
      "family": "IS",
      "isEnhancement": false,
      "baseControlId": "IS-05",
      "enhancementNumber": null,
      "text": "The organization: a.​ Implements secure session management for all interface types including session establishment, maintenance, and termination with continuous integrity verification; b.​ Provides session isolation mechanisms that prevent cross-session information leakage and maintain session boundaries throughout interface operations; and c.​ Implements session monitoring with real-time detection of session anomalies, hijacking attempts, and unauthorized session activities.",
      "discussion": "Interface session management ensures that interface sessions maintain security properties throughout their lifecycle while preventing session-based attacks and maintaining appropriate isolation between different users and operations.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-05(01)",
      "name": "Interface Session Management and Trust | Session Anomaly Detection",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-05",
      "enhancementNumber": 1,
      "text": "Implement automated detection of session anomalies including impossible travel scenarios, concurrent session conflicts, and behavioral deviations with automatic response procedures.",
      "discussion": "Session anomaly detection enables rapid identification of compromised sessions or suspicious activities while providing automated response capabilities to contain potential security incidents.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-06",
      "name": "INTERFACE LOGGING",
      "family": "IS",
      "isEnhancement": false,
      "baseControlId": "IS-06",
      "enhancementNumber": null,
      "text": "Metadata for each interface interaction is logged.",
      "discussion": "Logging interface metadata enables auditing of usage and investigation after the fact. This metadata may itself be sensitive and must be stored and accessed accordingly.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-06(01)",
      "name": "Interface Logging | Log Content",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-06",
      "enhancementNumber": 1,
      "text": "Log the content of [Assignment: type of interface] interactions.",
      "discussion": "For internal interfaces especially, there may be no need to protect the privacy of the content from the company itself. This data may be highly sensitive and must be stored and accessed accordingly.",
      "openQuestions": "Would we ever want this?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-07",
      "name": "RATE LIMITS",
      "family": "IS",
      "isEnhancement": false,
      "baseControlId": "IS-07",
      "enhancementNumber": null,
      "text": "a.​ The organization implements multi-tier rate limiting to prevent both burst attacks and long-term extraction, as well as have guaranteed control over compute allocation per job. b.​ Short-term rate limits restrict requests per minute/hour to prevent rapid extraction attempts. c.​ Long-term quotas limit cumulative usage over days/weeks/months to prevent gradual model distillation.",
      "discussion": "Some attacks may rely on a large volume of interface interactions. For example a large number of API requests could be used for model distillation. Also, large bandwidth usage could indicate model distillation as well.",
      "openQuestions": "Will there need to be exceptions for this?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "IS-07(01)",
      "name": "Rate Limits | Isolate Rate Limiting Mechanism",
      "family": "IS",
      "isEnhancement": true,
      "baseControlId": "IS-07",
      "enhancementNumber": 1,
      "text": "a.​ The rate limiting mechanism is an independent, standalone, single-purpose microservice that constrains the rate of change to a particular system or systems. b.​ This microservice is as simple as possible and amenable to rigorous testing.",
      "discussion": "Since the rate limiter stands in the way of using ordinary mechanisms to do exceptional or emergency actions, including those that could compromise the system, having high confidence in the systems that restrict these systems from performing rapid changes during ordinary operation is essential.",
      "openQuestions": "",
      "relatedControls": [
        "TODO NS - NETWORK SEPARATION"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-02",
      "name": "NETWORK SEPARATION",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-02",
      "enhancementNumber": null,
      "text": "All training and inference for models not available to public customers occurs on a separate network from the one on which customer inference occurs. These are respectively referred to as the Internal Isolated Network (IIN) and Customer Inference Network (CIN).",
      "discussion": "Continuing to serve customer inference will require a connection to the open internet and vastly expand the attack surface. Therefore customer inference should occur on a totally separate network.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-02(01)",
      "name": "Network Separation | Development and Testing Network",
      "family": "NS",
      "isEnhancement": true,
      "baseControlId": "NS-02",
      "enhancementNumber": 1,
      "text": "An additional internal network exists for the purpose of enabling devs to write and test software before approving it for use on the IIN. This can be referred to as the Development and Testing Network (DTN).",
      "discussion": "The IIN should only run software that has been thoroughly reviewed, which means that software must be developed on some other network. However the security of that network is also of high importance since it is guarding potentially cutting edge algorithmic secrets.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-02(02)",
      "name": "Network Separation | Large Experiment Network",
      "family": "NS",
      "isEnhancement": true,
      "baseControlId": "NS-02",
      "enhancementNumber": 2,
      "text": "An additional internal network exists for the purpose of running large scale experiments. This can be referred to as the Large Experiment Network (LEN).",
      "discussion": "Large experiments requiring a non-trivial percentage of all compute resources being run on a separate network would make that compute unavailable for large training runs on the IIN. Separating compute into separate networks will reduce flexibility and should only be done if a compelling reason is found why large experimental runs cannot happen on the IIN.",
      "openQuestions": "Would we even want this ever?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-03",
      "name": "MINIMAL CUSTOMER INFERENCE NETWORK",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-03",
      "enhancementNumber": null,
      "text": "The Customer Inference Network has access to the minimum set of resources required to serve customer inference.",
      "discussion": "To the extent that customer inference must occur on a network connected to the internet, that network should have access to the minimum necessary to perform inference. Any process that can be restricted to the IIN should be. As long as the CIN does not contain",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-04",
      "name": "AIR GAPPING",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-04",
      "enhancementNumber": null,
      "text": "The internal networks should be air gapped from any other network, including the CIN and internet with zero physical or logical connections.",
      "discussion": "To limit the attack surface of internal networks as much as possible, they should have physical connection to any other network. This should not imply a false sense of security within the internal network however, zero trust is still necessary.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-04(01)",
      "name": "Air Gapping | Verification",
      "family": "NS",
      "isEnhancement": true,
      "baseControlId": "NS-04",
      "enhancementNumber": 1,
      "text": "Monitors continuously for any attempts to establish unauthorized connections using organization-defined automated detection and manual inspection procedures.",
      "discussion": "Maintaining air gapping, especially with the potential of insider threats, can be challenging.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-05",
      "name": "INTERNAL NETWORK NODES",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-05",
      "enhancementNumber": null,
      "text": "All nodes of internal networks exist either within a closed enclave of a datacenter or inside a secure endpoint.",
      "discussion": "It is not feasible for all components of some internal networks (such as the IIN) to exist within the walls of a single datacenter, nor can all employees work directly from that datacenter. Therefore each node of the network should be behind its own layer of physical security and shielding. What this constitutes is defined in other control families.",
      "openQuestions": "Is “node” the right term here?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-06",
      "name": "DATA TRANSFER",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-06",
      "enhancementNumber": null,
      "text": "All data transferred into or out of air gapped networks is done so by approved transfer of physical storage devices.",
      "discussion": "This method of approved transfer by physical storage devices maintains the air gapping of networks and is similar to the procedures used to take data in and out of DoD classified networks.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-07",
      "name": "IMPORT AND EXPORT VALIDATION",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-07",
      "enhancementNumber": null,
      "text": "a.​ Any data to be imported to an air gapped network is first subjected to an automated security analysis. b.​ Analysis of imported data occurs in a detonation chamber. c.​ Any data to be exported is subject to an automated analysis to prevent exfiltration of sensitive data.",
      "discussion": "Attackers could be introduced to air gapped networks via transfer of storage devices. Safely verifying the contents of these transfers is essential. Similarly transfers may be used to exfiltrate sensitive data.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-08",
      "name": "MODEL TIERING",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-08",
      "enhancementNumber": null,
      "text": "a.​ Before a model is transferred to the CIN, it is certified safe for customer usage. Some more powerful models may not be certified safe and never leave the IIN. b.​ Customer available models are not capable of assisting with AI research except trivially and with what would be possible with public knowledge c.​ Customer available models are not capable of assisting with these other tasks: [Assignment: prohibited tasks]",
      "discussion": "As AI models become capable of automating AI research, customers must not have access to models that could be used to research and develop their own similarly powerful AI.",
      "openQuestions": "Should this be in a different family?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "NS-09",
      "name": "MODEL SANDBOXING",
      "family": "NS",
      "isEnhancement": false,
      "baseControlId": "NS-09",
      "enhancementNumber": null,
      "text": "TODO Something about evaluating potentially dangerous models in an environment within the internal network where they are further separated in a secure testing environment.",
      "discussion": "TODO",
      "openQuestions": "Should this be in a different family? Need to expand on this. PE - PHYSICAL AND ENVIRONMENTAL PROTECTION",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "PS-06(05)",
      "name": "Monitoring Physical Access | Mandatory Body Cameras",
      "family": "PS",
      "isEnhancement": true,
      "baseControlId": "PS-06",
      "enhancementNumber": 5,
      "text": "Maintenance activities shall involve mandatory comprehensive monitoring such as wide-angle body cameras, which if obstructed raise an alarm.",
      "discussion": "This provides a high-assurance, auditable record of all actions taken during physical maintenance on critical systems.",
      "openQuestions": "",
      "relatedControls": [
        "MA-02",
        "AU-2 PS - PERSONNEL SECURITY"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "PS-10",
      "name": "ACCESS AGREEMENTS FOR AI AGENTS",
      "family": "PS",
      "isEnhancement": false,
      "baseControlId": "PS-10",
      "enhancementNumber": null,
      "text": "a.​ Develops and documents access agreements for AI agents, defining their authorized activities, operational boundaries, and rules of engagement b.​ Reviews and updates of the access agreements for AI agents at an organization-defined frequency.",
      "discussion": "Under the assumption AI is “personnel\", this control establishes the foundational requirements for managing AI agents as distinct, auditable entities within the security framework.",
      "openQuestions": "",
      "relatedControls": [
        "TODO SC - SYSTEM COMMUNICATION PROTECTION"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-52",
      "name": "EXPOSED INTERCONNECTIONS",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-52",
      "enhancementNumber": null,
      "text": "Communications sent over accelerator interconnects, especially those containing weights or weight related values, must be encrypted with [Assignment: encryption algorithm].",
      "discussion": "Accelerator interconnect transmits weights or weights related values. Although the tremendous speed and volume of data on these cables, and their location in secure data centers does provide some security, these should still be encrypted. Encryption may be weaker in exchange for speed. Encryption at this speed may require dedicated hardware on accelerators.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-52(01)",
      "name": "Exposed Interconnect | Tamperproofing",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-52",
      "enhancementNumber": 1,
      "text": "Protect all accelerator interconnects with a tamperproof enclosure.",
      "discussion": "One possible way interconnect may be attacked is by attaching a snooping device. Tamperproofing the enclosure may mitigate this risk.",
      "openQuestions": "How feasible is tamperproofing, does it only need to be tamper evident? Should we give more specifics? Potential overlap with PE-03(05) Tamper Protection",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-53",
      "name": "BANDWIDTH LIMITING",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-53",
      "enhancementNumber": null,
      "text": "Bandwidth limiting is applied along paths where weights may be exfiltrated. Clients are leased a fixed amount of total bandwidth.",
      "discussion": "The large size of the weights works in favor of preventing exfiltration.",
      "openQuestions": "Do we want to limit by lease or limit total and then use leases not for security but to ration?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-54",
      "name": "QUANTUM-RESISTANT CRYPTOGRAPHY",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-54",
      "enhancementNumber": null,
      "text": "Implement quantum-resistant cryptographic algorithms for organization-defined high-value communications to protect against future quantum computing threats.",
      "discussion": "Given developments in quantum computing and the long-term value of AI models and training data, organizations should begin transitioning to quantum-resistant algorithms for protecting the most sensitive communications.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-55",
      "name": "PERFECT FORWARD SECRECY",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-55",
      "enhancementNumber": null,
      "text": "Implement cryptographic mechanisms that provide perfect forward secrecy for organization-defined communication sessions.",
      "discussion": "Perfect forward secrecy ensures that compromise of long-term keys does not compromise past communication sessions, which is critical for protecting historical AI development communications.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-56",
      "name": "TRANSFER MEDIA MULTIPARTY AUTHENTICATION",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-56",
      "enhancementNumber": null,
      "text": "Require authorization and oversight from organization-defined multiple independent parties for all physical media transfers involving the IIN, with segregation of duties for transfer operations.",
      "discussion": "Multiparty authorization limits the risk of a single insider threat making an illicit transfer.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-57",
      "name": "TRANSFER MEDIA CHAIN OF CUSTODY",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-57",
      "enhancementNumber": null,
      "text": "Maintain comprehensive chain of custody documentation for all physical media transfers with real-time tracking, tamper detection, and attribution to specific authorized personnel.",
      "discussion": "Chain of custody provides accountability and traceability for all inter-network data transfers while enabling investigation of any transfer anomalies or security incidents.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-58",
      "name": "TRANSFER MEDIA CRYPTOGRAPHIC PROTECTION",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-58",
      "enhancementNumber": null,
      "text": "Implement organization-defined quantum-resistant cryptographic protection for all data stored on physical transfer media with independent key management and integrity verification.",
      "discussion": "Cryptographic protection ensures confidentiality and integrity of transferred data while quantum-resistant algorithms provide protection against future cryptographic attacks on historical transfers.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-59",
      "name": "TRANSFER MEDIA SANITATION",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-59",
      "enhancementNumber": null,
      "text": "Implement secure sanitization procedures for transfer media after use, including organization-defined overwriting or destruction methods.",
      "discussion": "Proper media sanitization prevents data recovery from used transfer media and eliminates potential information leakage from residual data.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60",
      "name": "SIDE-CHANNEL PROTECTION",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-60",
      "enhancementNumber": null,
      "text": "The organization: a.​ Implements organization-defined controls to protect against side-channel attacks targeting communication systems; b.​ Monitors for indicators of side-channel attack attempts; and c.​ Maintains organization-defined defensive measures against power analysis, electromagnetic, acoustic, and cache-based attacks.",
      "discussion": "High-performance AI systems are particularly vulnerable to side-channel attacks due to their computational intensity and data processing patterns. Protection must address multiple attack vectors including timing, power, and electromagnetic side channels.",
      "openQuestions": "Should we consider additional side channels?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(01)",
      "name": "Side-Channel Protection | Power Analysis",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 1,
      "text": "Implement power analysis countermeasures for organization-defined critical communication components, including power line filtering and consumption masking techniques.",
      "discussion": "Power consumption patterns during cryptographic operations or sensitive data processing can leak information. Countermeasures help prevent differential power analysis attacks, including those that do not directly measure power but instead acoustic signals generated by powered components.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(02)",
      "name": "Side-Channel Protection | Cache Timing",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 2,
      "text": "Implement cache timing attack countermeasures in organization-defined systems through cache partitioning, randomization, or other mitigation techniques.",
      "discussion": "Cache timing attacks can extract cryptographic keys or sensitive data by analyzing memory access patterns. Mitigation is particularly important for shared infrastructure used in AI training.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(03)",
      "name": "Side-Channel Protection | Electromagnetic Emanation",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 3,
      "text": "Implement controls to minimize and shield electromagnetic emanations from organization-defined communication equipment to prevent information leakage.",
      "discussion": "Communication equipment can leak information through electromagnetic emanations. Proper shielding and emission control prevent this information from being intercepted.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(04)",
      "name": "Side-Channel Protection | Optical Shielding",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 4,
      "text": "Implement controls to minimize and shield optical signals like power LEDs to prevent information leakage.",
      "discussion": "Something as simple as an LED attached to the same power supply as the processor can create a high-bandwidth channel for leaking information which can be observed from a significant distance. Something as simple as taping over such lights could prevent this.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(05)",
      "name": "Side-Channel Protection | Displays",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 5,
      "text": "Implement controls to minimize and shield signals that may allow an attacker to reconstruct the content of electronic displays and display cables, including Van Eck Phreaking.",
      "discussion": "Emanations from LCD displays or HDMI cables have been used to reconstruct the content of the display with high fidelity. Methods such as shielding, using more secure encodings, adding noise, and recoloring the content of displays could reduce the effectiveness of these attacks.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(06)",
      "name": "Side-Channel Protection | Wide Band Noise Generator",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 6,
      "text": "Install devices that generate wide band noise at sufficient volume to drown out any acoustic side-channels.",
      "discussion": "Rather than removing all sources of acoustic signals, simply drowning them out by lowering the signal to noise ratio may be effective. Defending against acoustic side-channels by generating noise may have ergonomic concerns that need to be considered.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(07)",
      "name": "Side-Channel Protection | Wide Band EMF Generator",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 7,
      "text": "Install devices that generate wide band electromagnetic noise at sufficient intensity to drown out any electromagnetic side-channels.",
      "discussion": "Rather than removing all sources of EMF signals, simply drowning them out by lowering the signal to noise ratio may be effective.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(08)",
      "name": "Side-Channel Protection | Algorithmic Noise",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 8,
      "text": "Write software that indicates which sensitive operations should be shielded by active noise generation.",
      "discussion": "Generating enough noise to drown out a signal (of any type) may be costly in terms of energy consumption and or disruption. Creating noise specifically when something needs to be shielded could reduce the burden while preserving the benefits.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(09)",
      "name": "Side-Channel Protection | Constant Time Functions",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 9,
      "text": "Sensitive functions should be written to run with constant time and equal branching so they do not produce recognizably different signals based on different inputs.",
      "discussion": "Many side-channel attacks rely on exploiting a vulnerability in a function that causes a different computational load depending on the input which the attacker is trying to deduce. A common way of defending against these techniques is to carefully write sensitive functions to behave indistinguishably regardless of the input.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(10)",
      "name": "Side-Channel Protection | Avoid Compression",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 10,
      "text": "Avoid compressing sensitive data.",
      "discussion": "Compression algorithms are usually based on reducing repeated patterns in the data. Attackers can exploit this to infer what data is being compressed.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-60(11)",
      "name": "Side-Channel Protection | Signal Padding",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-60",
      "enhancementNumber": 11,
      "text": "Signal padding is used to obscure communication patterns and prevent traffic analysis of encrypted communications through: a.​ Message size padding using [Selection (one): fixed-size buckets, exponential buckets, adaptive padding]. b.​ Dummy traffic generation at [Assignment: organization-defined intervals]. c.​ Traffic shaping to eliminate timing correlations.",
      "discussion": "Signal padding prevents side-channel attacks that infer sensitive information from observable communication metadata like message sizes, timing, and traffic volume. This protects against traffic analysis attacks that can reveal user behavior and operational patterns even when message content is encrypted.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-61",
      "name": "DARK FIBER",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-61",
      "enhancementNumber": null,
      "text": "Internal network connections between buildings are made over leased dark fiber lines.",
      "discussion": "Dark fiber allows ownership and control over the equipment at both ends of the fiber, which is leased to a single tenant. This enables greater security than a public connection or typical leased line.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-61(01)",
      "name": "Dark Fiber | Splice Detection",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-61",
      "enhancementNumber": 1,
      "text": "Baseline optical properties of dark fiber cables and retest at regular intervals to detect the addition of any splices to the cable.",
      "discussion": "One possible attack on dark fiber is that someone with physical access along the path of the cable digs it up and splices it. This would change certain physical properties of the cable that can be measured with techniques like optical time domain reflectometry and measuring optical loss. Comparing these against a baseline may identify splices.",
      "openQuestions": "What about the possibility the cable was already spliced before you baselined it?",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-62",
      "name": "INLINE NETWORK ENCRYPTORS",
      "family": "SC",
      "isEnhancement": false,
      "baseControlId": "SC-62",
      "enhancementNumber": null,
      "text": "Internal network connections between buildings are secured at each end with pairs of inline network encryptors.",
      "discussion": "This approach is similar to how classified DoD networks like SIPRNet function. For DoD purposes, inline network encryptors allow higher level classification traffic to go over lower level classification networks.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-62(01)",
      "name": "Inline Network Encryptors | Type 1 Encryptors",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-62",
      "enhancementNumber": 1,
      "text": "Network encryptors are NSA Certified Type 1.",
      "discussion": "NSA Certified Type 1 encryptors offer a higher level of security than enterprise alternatives, but cannot be purchased without the involvement of the Federal Government.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SC-62(02)",
      "name": "Inline Network Encryptors | Layering",
      "family": "SC",
      "isEnhancement": true,
      "baseControlId": "SC-62",
      "enhancementNumber": 2,
      "text": "a.​ Connections are made with [Assignment: number] layers of network encryptors. b.​ Layers should use [Selection (one): the same, different] type(s) of network encryptor.",
      "discussion": "Layering multiple network encryptors may provide more security than just one. Using different types of network encryptors in series could provide defense in depth against a vulnerability in any one.",
      "openQuestions": "",
      "relatedControls": [
        "TODO SI - SYSTEM AND INFORMATION INTEGRITY"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SI-10(07)",
      "name": "Information Input Validation | Model Inputs",
      "family": "SI",
      "isEnhancement": true,
      "baseControlId": "SI-10",
      "enhancementNumber": 7,
      "text": "Inputs to models are checked for content designed to produce a harmful result. If detected, the request is denied and the denial is logged.",
      "discussion": "Models could be prompted into behaving in bad ways. This could include responding with sensitive information or performing malicious actions.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SI-15(01)",
      "name": "Information Output Filtering | Side-Channel Attack Prevention",
      "family": "SI",
      "isEnhancement": true,
      "baseControlId": "SI-15",
      "enhancementNumber": 1,
      "text": "Implement side-channel attack prevention mechanisms in input processing including timing normalization, resource usage masking, and processing pattern randomization.",
      "discussion": "Side-channel attack prevention ensures that input processing does not leak information through timing patterns, resource consumption, or other observable characteristics that could be exploited by sophisticated attackers.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "SI-15(02)",
      "name": "Information Output Filtering | Covert Channel Detection and Prevention",
      "family": "SI",
      "isEnhancement": true,
      "baseControlId": "SI-15",
      "enhancementNumber": 2,
      "text": "Implement comprehensive covert channel detection mechanisms for API outputs including steganographic content analysis, statistical pattern analysis, and behavioral anomaly detection for potential unauthorized communications.",
      "discussion": "Covert channel detection prevents AI models from establishing unauthorized communications through subtle patterns, statistical anomalies, or encoded information embedded in their outputs.",
      "openQuestions": "",
      "relatedControls": [
        "TODO ZT - ZERO TRUST"
      ],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-02",
      "name": "ZERO TRUST",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-02",
      "enhancementNumber": null,
      "text": "All communications are secured regardless of network location.",
      "discussion": "Zero Trust Architecture does away with the assumption that because communication is within a secure network it can be implicitly trusted. This does not mean however that secure networks cannot be used in addition to zero trust for an additional layer of security.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-03",
      "name": "PER-SESSION ACCESS",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-03",
      "enhancementNumber": null,
      "text": "All access to resources is granted on a per-session basis.",
      "discussion": "Evaluating trust should not grant permanent access. To balance this with useability, in some cases an evaluation of trust be valid for some small time window and not occur directly before initiating a session. However, authentication and authorization to one resource should not automatically grant access to a different resource.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-04",
      "name": "POLICY ENFORCEMENT POINTS",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-04",
      "enhancementNumber": null,
      "text": "a.​ All enterprise business process traffic passes through one or more Policy Enforcement Points (PEP). b.​ Resources should only accept connections established by a PEP. c.​ The PEP is responsible for enabling, monitoring, and eventually terminating connections between a subject and an enterprise resource.",
      "discussion": "The PEP communicates with the Policy Administrator to forward requests and/or receive policy updates. The PEP may be broken into two different components: the client (e.g., agent on a laptop) and resource side (e.g., gateway component in front of resource that controls access) or a single portal component that acts as a gatekeeper for communication paths. Beyond the PEP is the trust zone hosting the resource.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-04(01)",
      "name": "Policy Enforcement Points | Hidden Resources",
      "family": "ZT",
      "isEnhancement": true,
      "baseControlId": "ZT-04",
      "enhancementNumber": 1,
      "text": "Some resources may not be discoverable without accessing a PEP.",
      "discussion": "Making a resource undiscoverable without first accessing a PEP can protect against DoS attacks or scanning. However some resources like DNS servers must be discoverable.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-04(02)",
      "name": "Policy Enforcement Points | Inaccessible PEPs",
      "family": "ZT",
      "isEnhancement": true,
      "baseControlId": "ZT-04",
      "enhancementNumber": 2,
      "text": "Some PEPs may not be accessible or observable to all assets",
      "discussion": "",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-05",
      "name": "POLICY ENGINE",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-05",
      "enhancementNumber": null,
      "text": "a.​ The ultimate decision to grant a subject access to a resource is made by a Policy Engine (PE). b.​ The PE uses a trust algorithm which takes in policy as well as input from external sources to grant, deny, or revoke access to a resource. c.​ All PE decisions are logged and executed by the Policy Administrator.",
      "discussion": "The Policy Engine may rely on many different factors to make its decision. To see a detailed listing of potential inputs, see page 10 of NIST SP 800-207",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-06",
      "name": "POLICY ADMINISTRATOR",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-06",
      "enhancementNumber": null,
      "text": "a.​ Communication paths between subjects and resources are established by a Policy Administrator (PA) via commands to the relevant PEPs. b.​ The PA generates any session-specific authentication and authentication token or credential used to access the enterprise resource.",
      "discussion": "It may be possible for some implementations to treat the PE and PA (collectively the Policy Decision Point) as a single service.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-07",
      "name": "POLICY ADMINISTRATOR ACCESS",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-07",
      "enhancementNumber": null,
      "text": "a.​ The PEPs are the only components that accesses the PA as part of a business flow. b.​ Each PEP operating on the enterprise network has a connection to the policy administrator to establish communication paths from clients to resources.",
      "discussion": "",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-08",
      "name": "MANAGED ASSETS",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-08",
      "enhancementNumber": null,
      "text": "a.​ Only managed devices should be granted access to resources. b.​ Managed assets should assert their identity with authenticated (non-spoofable) information. c.​ Managed assets should assert their state/security posture.",
      "discussion": "No asset should be inherently trusted. The security posture of assets should be used when evaluating a request. Asset state can include device characteristics such as software versions, network location, time of the request, or installed credentials.",
      "openQuestions": "Should this control be removed for redundancy? See IA-3",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-09",
      "name": "NETWORK TRAFFIC LOGGING",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-09",
      "enhancementNumber": null,
      "text": "a.​ All network traffic is observable. b.​ Packets seen on the data plane are recorded.",
      "discussion": "TODO",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-09(01)",
      "name": "Network Traffic Logging | Dynamic Policy Updates",
      "family": "ZT",
      "isEnhancement": true,
      "baseControlId": "ZT-09",
      "enhancementNumber": 1,
      "text": "Metadata from connections is used to dynamically update policies and inform the PE as it evaluates access requests.",
      "discussion": "",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-10",
      "name": "CONTROL PLANE SEPARATION",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-10",
      "enhancementNumber": null,
      "text": "a.​ The PE, PA, and PEPs communicate on a network that is logically separate and not directly accessible by assets or resources. b.​ The data plane is used for application/service traffic  and the control plane is to manage paths between assets. c.​ Policy enforcement points can send and receive messages from both the data and control planes.",
      "discussion": "TODO",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    },
    {
      "id": "ZT-11",
      "name": "SCALABILITY",
      "family": "ZT",
      "isEnhancement": false,
      "baseControlId": "ZT-11",
      "enhancementNumber": null,
      "text": "The infrastructure used to support the ZTA access decision process should be made scalable to account for changes in process load.",
      "discussion": "The PE(s), PA(s), and PEPs used in a ZTA become the key components in any business process. Delay or inability to reach a PEP (or inability of the PEPs to reach the PA/PE) negatively impacts the ability to perform the workflow. An enterprise implementing a ZTA needs to provision the components for the expected workload or be able to rapidly scale the infrastructure to handle increased usage when needed.",
      "openQuestions": "",
      "relatedControls": [],
      "metadata": {
        "source": "SL5 Control Export"
      }
    }
  ]
}