Mapped to NIST 800-171 Requirement: 3.13.6
CMMC Assessment Objective: SC.L2-3.13.6[a]
What This Control Means
You must identify where critical security functions are segregated from standard system operations, such as:
• Access control enforcement
• Logging and audit capability
• Security configuration management
• System integrity monitoring
• Cryptographic module operation
These components should be logically or physically isolated from general user processes to prevent accidental or malicious interference.
Why It Matters
Without separation of security functions:
• Regular users or applications could disable or bypass protections
• Malicious actors could modify logs, change access policies, or weaken encryption settings
• There’s no clear enforcement point for critical security decisions
This control reduces your attack surface and supports control integrity and enforcement.
How to Implement It
1. Identify Core Security Functions in Your Environment Common examples:
• Authentication mechanisms (e.g., Active Directory, IAM platforms)
• Firewalls and endpoint protection agents
• Audit log services (e.g., Windows Event Viewer, syslog)
• Configuration management tools (e.g., SCCM, Puppet)
2. Determine Their Isolation Method
• Logical separation: Roles, permissions, separate processes
• Physical separation: Dedicated hardware or appliances
• Service-based separation: Microservices or isolated daemons for authentication, logging, etc.
3. Document the Separation
• Show how these functions:
◦ Are restricted to admin roles
◦ Run in separate processes or systems
◦ Are monitored for integrity
4. Review Critical Infrastructure
• Are firewall rules editable by all users?
• Can standard users access logging systems?
• Are admin portals segmented from user interfaces?
Evidence the Assessor Will Look For
• List of systems or modules that perform isolated security functions
• Network or system architecture diagrams highlighting these components
• SSP entries explaining how functions like access control or logging are separated
• Configurations showing restricted access to those modules
• Supporting documentation from third-party security tools or services
Common Gaps
• Security functions run alongside user apps without privilege separation
• Logging or audit settings can be altered by general users
• Firewall rules or account management is accessible without proper controls
• No documentation describing how key protections are isolated
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Mapping and documenting security-specific modules and functions in your SSP
• Identifying where those functions are segmented from user-accessible components
• Tracking security tool configurations and associated roles
• Flagging any controls that lack appropriate logical or physical separation
• Providing auditors with clear documentation of your architecture
With Cuick Trac, your security functions are defined, isolated, and auditable.
Final CTA
Security controls need protection too.
Schedule a Cuick Trac demo to identify and document your isolated security functions and keep your CUI environment resilient.