{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"technical","domain":"Network & Communications Security","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-NET-04","description":"Separate user functionality, including user-interface services, from system-management functionality, and isolate security functions from non-security functions using partitioning, virtualization, or separate physical or logical components. Partition the system so components of differing sensitivity reside in separate domains, limiting the blast radius of a compromise.","details":{"control_category":"technical","control_type":"preventive","domain":"Network & Communications Security","guidance":[],"members":[{"control_id":"SC-2","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"SC-3","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"SC-32","coverage":"full","framework":"nist-800-53","relationship":"superset_of"}],"statement":"Separate user functionality, including user-interface services, from system-management functionality, and isolate security functions from non-security functions using partitioning, virtualization, or separate physical or logical components. Partition the system so components of differing sensitivity reside in separate domains, limiting the blast radius of a compromise.","title":"Isolate system, user, and security functions","unified_id":"UC-NET-04"},"id":"uc:UC-NET-04","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-NET-04","sourceIds":["nist-800-53"],"sourceUrl":null,"title":"UC-NET-04 — Isolate system, user, and security functions","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2068651eb4af6f3210907fb19d21974a3d5a77019903be16cb9e1765ba58ed2c","properties":{"rationale":"Partitioning components of differing sensitivity into separate domains reinforces the isolation a multi-tenancy exploit tries to violate.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/risk-net-cloud-multitenancy-exploit-d98521d5.json","targetId":"risk:net-cloud-multitenancy-exploit","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:24547989268308a0eb50eb991369cf8ccd6ac6be2f2147f13a4bd495c54dc9ea","properties":{"control_id":"SC-32","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-sc-32-af47ce56.json","targetId":"ctrl:nist-800-53:SC-32","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:555c305b867382f6e047236ce939a617dc892557ae2f1ac3b7fedf661df555ed","properties":{"rationale":"Isolating functions and partitioning domains limits an adversary's lateral movement and progression across systems.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:58227ab69abdc4d27697e5c4b77cd8bb0d0db6fff241e4f288abefaf8046ea37","properties":{"control_id":"SC-2","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-sc-2-4e0c1700.json","targetId":"ctrl:nist-800-53:SC-2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:635338f7e05b03c1d8773471b3f96f488881db9ff56c9eda531c3710b6f80457","properties":{},"sourceDetailPath":"/data/v1/records/wf-c50-4402d67a.json","sourceId":"wf:C50","targetDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","targetId":"uc:UC-NET-04","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a88e5bd7566bdcc81b3d1096ed64ebf08b7f130d99041065a703e6dbd6464459","properties":{"control_id":"SC-3","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-sc-3-1bcbe7d4.json","targetId":"ctrl:nist-800-53:SC-3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c829f097322ae0baf2dd38c5330e3becf82375e75e58469fc43aa98e2bbc8300","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","targetId":"uc:UC-NET-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d1ef145c300c5ec43c8583463713c61a943f0db18419510d23051ebd9fe3ae60","properties":{"rationale":"Partitioning the system into separate domains of differing sensitivity limits ransomware lateral spread and blast radius (mustKeep).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f59a81df5aef8a16fce8ab35d5f83ac965b3271ee53c3f648004f654951bceb8","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","targetId":"uc:UC-NET-04","type":"tests"}],"schemaVersion":1}