{
    "control": "SC-3",
    "title": "Security Function Isolation",
    "ccis": [
        {
            "cci": "CCI-001084",
            "definition": "Isolate security functions from nonsecurity functions."
        },
        {
            "cci": "CCI-001085",
            "definition": "Employ hardware separation mechanisms to implement security function isolation."
        },
        {
            "cci": "CCI-001086",
            "definition": "Isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions."
        },
        {
            "cci": "CCI-001089",
            "definition": "Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers."
        },
        {
            "cci": "CCI-002381",
            "definition": "Minimize the number of nonsecurity functions included within the isolation boundary containing security functions."
        },
        {
            "cci": "CCI-002382",
            "definition": "Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules."
        }
    ],
    "rules_mapped": 37,
    "rules": [
        {
            "rule": "V-242434",
            "stig_id": "CNTR-K8-001620",
            "title": "Kubernetes Kubelet must enable kernel protection.",
            "severity": "high",
            "benchmark": "Kubernetes",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-220799",
            "stig_id": "WN10-CC-000037",
            "title": "Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 10",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-220832",
            "stig_id": "WN10-CC-000200",
            "title": "Administrator accounts must not be enumerated during elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 10",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-220945",
            "stig_id": "WN10-SO-000250",
            "title": "User Account Control must, at minimum, prompt administrators for consent on the secure desktop.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 10",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-220948",
            "stig_id": "WN10-SO-000260",
            "title": "User Account Control must be configured to detect application installations and prompt for elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 10",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-220949",
            "stig_id": "WN10-SO-000265",
            "title": "User Account Control must only elevate UIAccess applications that are installed in secure locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 10",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-220951",
            "stig_id": "WN10-SO-000275",
            "title": "User Account Control must virtualize file and registry write failures to per-user locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 10",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-253357",
            "stig_id": "WN11-CC-000037",
            "title": "Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 11",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-253391",
            "stig_id": "WN11-CC-000200",
            "title": "Administrator accounts must not be enumerated during elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 11",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-253469",
            "stig_id": "WN11-SO-000250",
            "title": "User Account Control must prompt administrators for consent on the secure desktop.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 11",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-253472",
            "stig_id": "WN11-SO-000260",
            "title": "User Account Control must be configured to detect application installations and prompt for elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 11",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-253473",
            "stig_id": "WN11-SO-000265",
            "title": "User Account Control must only elevate UIAccess applications that are installed in secure locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 11",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-253475",
            "stig_id": "WN11-SO-000275",
            "title": "User Account Control must virtualize file and registry write failures to per-user locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows 11",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205714",
            "stig_id": "WN19-CC-000240",
            "title": "Windows Server 2019 administrator accounts must not be enumerated during elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205715",
            "stig_id": "WN19-MS-000020",
            "title": "Windows Server 2019 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205716",
            "stig_id": "WN19-SO-000390",
            "title": "Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205717",
            "stig_id": "WN19-SO-000400",
            "title": "Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205718",
            "stig_id": "WN19-SO-000420",
            "title": "Windows Server 2019 User Account Control must be configured to detect application installations and prompt for elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205719",
            "stig_id": "WN19-SO-000430",
            "title": "Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-205720",
            "stig_id": "WN19-SO-000450",
            "title": "Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2019",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254355",
            "stig_id": "WN22-CC-000240",
            "title": "Windows Server 2022 administrator accounts must not be enumerated during elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254429",
            "stig_id": "WN22-MS-000020",
            "title": "Windows Server 2022 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254483",
            "stig_id": "WN22-SO-000390",
            "title": "Windows Server 2022 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254484",
            "stig_id": "WN22-SO-000400",
            "title": "Windows Server 2022 User Account Control (UAC) must, at a minimum, prompt administrators for consent on the secure desktop.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254486",
            "stig_id": "WN22-SO-000420",
            "title": "Windows Server 2022 User Account Control (UAC) must be configured to detect application installations and prompt for elevation.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254487",
            "stig_id": "WN22-SO-000430",
            "title": "Windows Server 2022 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-254489",
            "stig_id": "WN22-SO-000450",
            "title": "Windows Server 2022 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.",
            "severity": "medium",
            "benchmark": "Microsoft Windows Server 2022",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-230240",
            "stig_id": "RHEL-08-010170",
            "title": "RHEL 8 must use a Linux Security Module configured to enforce limits on system services.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 8",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-230241",
            "stig_id": "RHEL-08-010171",
            "title": "RHEL 8 must have policycoreutils package installed.",
            "severity": "low",
            "benchmark": "Red Hat Enterprise Linux 8",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-230277",
            "stig_id": "RHEL-08-010421",
            "title": "RHEL 8 must clear the page allocator to prevent use-after-free attacks.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 8",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-230278",
            "stig_id": "RHEL-08-010422",
            "title": "RHEL 8 must disable virtual syscalls.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 8",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-230279",
            "stig_id": "RHEL-08-010423",
            "title": "RHEL 8 must clear memory when it is freed to prevent use-after-free attacks.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 8",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-257792",
            "stig_id": "RHEL-09-212035",
            "title": "RHEL 9 must disable virtual system calls.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 9",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-257793",
            "stig_id": "RHEL-09-212040",
            "title": "RHEL 9 must clear the page allocator to prevent use-after-free attacks.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 9",
            "ccis": [
                "CCI-001084"
            ]
        },
        {
            "rule": "V-257794",
            "stig_id": "RHEL-09-212045",
            "title": "RHEL 9 must clear memory when it is freed to prevent use-after-free attacks.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 9",
            "ccis": [
                "CCI-001084",
                "CCI-002824"
            ]
        },
        {
            "rule": "V-258078",
            "stig_id": "RHEL-09-431010",
            "title": "RHEL 9 must use a Linux Security Module configured to enforce limits on system services.",
            "severity": "high",
            "benchmark": "Red Hat Enterprise Linux 9",
            "ccis": [
                "CCI-001084",
                "CCI-002696"
            ]
        },
        {
            "rule": "V-258081",
            "stig_id": "RHEL-09-431025",
            "title": "RHEL 9 must have policycoreutils package installed.",
            "severity": "medium",
            "benchmark": "Red Hat Enterprise Linux 9",
            "ccis": [
                "CCI-001084"
            ]
        }
    ]
}