Organizational Control: Operations Security
| Control ID: SC-38 Operations Security | Family: System and Communications Protection | Source: NIST 800-53r4 |
| Control: The organization employs [Assignment: organization-defined operations security safeguards] to protect key organizational information throughout the system development life cycle. | ||
| Supplemental Guidance: Operations security (OPSEC) is a systematic process by which potential adversaries can be denied information about the capabilities and intentions of organizations by identifying, controlling, and protecting generally unclassified information that specifically relates to the planning and execution of sensitive organizational activities. The OPSEC process involves five steps: (i) identification of critical information (e.g., the security categorization process); (ii) analysis of threats; (iii) analysis of vulnerabilities; (iv) assessment of risks; and (v) the application of appropriate countermeasures. OPSEC safeguards are applied to both organizational information systems and the environments in which those systems operate. OPSEC safeguards help to protect the confidentiality of key information including, for example, limiting the sharing of information with suppliers and potential suppliers of information system components, information technology products and services, and with other non-organizational elements and individuals. Information critical to mission/business success includes, for example, user identities, element uses, suppliers, supply chain processes, functional and security requirements, system design specifications, testing protocols, and security control implementation details. Related Controls: RA-2, RA-5, SA-12 |
||
| Control Enhancements: N/A | ||
| References: N/A | ||
| Mechanisms: | ||
| Protocol Implementation Conformance Statements: N/A | ||