3.13.3Separate admin interfaces from user interfaces
Management consoles are not sitting alongside ordinary user functionality.
The requirement, verbatim
NIST SP 800-171 Rev. 2 · 3.13.3Separate user functionality from system management functionality.
NIST's discussion
System management functionality includes functions necessary to administer databases, network components, workstations, or servers, and typically requires privileged user access. The separation of user functionality from system management functionality is physical or logical. Organizations can implement separation of system management functionality from user functionality by using different computers, different central processing units, different instances of operating systems, or different network addresses; virtualization techniques; or combinations of these or other methods, as appropriate. This type of separation includes web administrative interfaces that use separate authentication methods for users of any other system resources. Separation of system and user functionality may include isolating administrative interfaces on different domains and with additional access controls.
NIST SP 800-171 Rev. 2, discussion under 3.13.3. Whitespace normalised; wording unchanged.
Assessment objectives
An assessor decides each of these separately. The requirement is met only when every objective is.
- [a] user functionality is identified
- [b] system management functionality is identified
- [c] user functionality is separated from system management functionality
NIST SP 800-171A, determination statements for 3.13.3.
For assessors: examine, interview, test
NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.
Examine
- System and communications protection policy
- procedures addressing application partitioning
- system design documentation
- system configuration settings and associated documentation
- system security plan
- system audit logs and records
- other relevant documents or records
Interview
- System or network administrators
- personnel with information security responsibilities
- system developer
Test
- Separation of user functionality from system management functionality
NIST SP 800-171A, potential assessment methods and objects for 3.13.3.
Evidence
No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.
Scoring weight
Worth 1 point. Not meeting this requirement subtracts 1 from your 110-point SPRS score.
DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.
In Rev. 3
Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is withdrawn and incorporated elsewhere: 03.01.01 Account Management, 03.01.02 Access Enforcement, 03.01.03 Information Flow Enforcement, 03.01.04 Separation of Duties, 03.01.05 Least Privilege, 03.01.06 Least Privilege – Privileged Accounts, 03.01.07 Least Privilege – Privileged Functions.
See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.
Related requirements
Where this page's facts come from
- Requirement text
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
- Discussion
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
- Practice name
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
- Objectives
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
- Examine, interview, test
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
- Level
- bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
- Weight
- bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
- Rev. 3 mapping
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
- Plain-language title and summary
- editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)