SC-7(4) External Telecommunications Services

Control enhancement of SC-7 Boundary Protection

Control

(a)

Implement a managed interface for each external telecommunication service;

(b)

Establish a traffic flow policy for each managed interface;

(c)

Protect the confidentiality and integrity of the information being transmitted across each interface;

(d)

Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;

(e)

Review exceptions to the traffic flow policy [Assignment: frequency] and remove exceptions that are no longer supported by an explicit mission or business need;

(f)

Prevent unauthorized exchange of control plane traffic with external networks;

(g)

Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and

(h)

Filter unauthorized control plane traffic from external networks.

Discussion

External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic include Border Gateway Protocol (BGP) routing, Domain Name System (DNS), and management protocols. See [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.

Related controls

Need SC-7(4) implemented and evidenced?

We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.

Request an assessment

Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.