Secure Name/Address Resolution Service (Authoritative Source) SC-20

System and Communications Protection · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SC-20 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-20 (Secure Name/Address Resolution Service — Authoritative Source) applies when your server answers DNS (Domain Name System) queries as the authority for a zone. DNS is the service that turns names like example.com into network addresses. This control says: when you hand out those answers, also hand out proof that each answer is genuine and unaltered, and make it possible to verify a chain of trust from a parent domain down to its child zones. In practice that means signing your zone with DNSSEC (Domain Name System Security Extensions), which adds cryptographic signatures to DNS answers. It is a Low-baseline control.

What good looks like

If your server is authoritative for a zone, sign that zone with DNSSEC so its answers carry cryptographic signatures.
Publish the signing keys correctly so resolvers can verify a chain of trust from the parent domain down to yours.
Keep signatures fresh — DNSSEC signatures expire, so re-signing and key rollover need to be routine.
Make sure the security status of child zones can be checked, by publishing the records that link parent to child.
If your server is not an authoritative DNS server, record that — this control then does not apply to it.

Framework mapping

NIST CSF 2.0 — PR.IR-01 — Networks and environments are protected from unauthorized logical access and usage
CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software

How to move it toward Implemented

Confirm whether the server runs an authoritative DNS service (ss -ulpn | grep :53, and check for named from BIND or nsd); if none, note ‘not an authoritative DNS server’ and stop here.
If it is authoritative, enable DNSSEC signing for the zone (on BIND, a common DNS server, set dnssec-policy in named.conf) and verify with dig +dnssec <zone> that signature (RRSIG) records come back.
Publish the DS (Delegation Signer) record to the parent zone so the chain of trust resolves, and validate end to end with delv <name>.
Save the signed-zone check (the dig +dnssec output) as a dated file.
Attach that DNSSEC verification as hardening evidence on the asset, naming SC-20 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.