Architecture and Provisioning for Name/Address Resolution Service SC-22

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-22 (Architecture and Provisioning for Name/Address Resolution Service) is about how your DNS (Domain Name System) is built, not a single setting. It asks for two things: fault tolerance — name resolution should keep working if one server fails, so you run more than one — and role separation — the servers that answer the outside world should be separate from the ones that answer your internal network. DNS is the service that turns names into network addresses; if it goes down or gets confused, everything that depends on names goes with it. It is a Low-baseline control.

What good looks like

• Run more than one name server so a single failure does not take resolution down — a primary and at least one secondary.
• Put the redundant servers in separate locations or networks where you can, so one outage does not hit both.
• Separate internal and external roles: the server answering the internet should not be the one answering your internal clients.
• Restrict who can query each server — an internal resolver should not be open to the whole internet.
• Keep the primary and secondary in sync with a reliable zone-transfer setup.

Framework mapping

• NIST CSF 2.0 — PR.IR-01 — Networks and environments are protected from unauthorized logical access and usage
• CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software

How to move it toward Implemented

• Confirm at least a second name server exists for each zone (dig NS <zone>) and that a secondary is receiving updates; if only one exists, provision a secondary.
• Separate roles in configuration: on BIND (a common DNS server) use view blocks — an ‘internal’ view and an ‘external’ view — so internal and external clients get their own service.
• Lock down queries and zone transfers with allow-query and allow-transfer access lists, so only the right clients and the secondary can reach each role.
• Save the topology notes (which servers, which roles, which locations) and the dig NS output as a dated file.
• Attach that DNS architecture record as hardening evidence on the asset, naming SC-22 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.