Information in Shared System Resources SC-4

System and Communications Protection · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SC-4 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-4 (Information in Shared System Resources) is about not leaking leftover data. When one process or user is finished with a shared resource — memory, a CPU register, disk blocks, a temporary file — the next user of that resource must not be able to read what the last one left behind. It is sometimes called object reuse, or residual-information protection. It is an SC (System and Communications Protection) control in the Moderate baseline.

What good looks like

Rely on the operating system to clear or isolate resources between users — modern Linux zeroes freed memory before handing it to another process — and keep the kernel patched so that stays true.
Do not let sensitive data linger in shared, world-readable places such as /tmp or shared caches.
Restrict permissions so one user cannot read another user’s files, temporary data, or process memory.
Wipe or encrypt storage that is reused or decommissioned so old data does not resurface.
Be deliberate with shared services (databases, caches): scope each tenant’s data so one session cannot see another’s residue.

Framework mapping

NIST CSF 2.0 — PR.DS-01 — The confidentiality, integrity, and availability of data-at-rest are protected
CIS Controls v8 — Control 3 — Data Protection

How to move it toward Implemented

Set the sticky bit on shared temporary directories so users cannot touch each other’s files (chmod 1777 /tmp; verify with ls -ld /tmp).
Tighten the default umask to 027 (in /etc/profile or the login defaults) so new files are not readable by other users, and keep the kernel and services patched (apt upgrade or dnf update).
For storage that is reused or retired, wipe or encrypt it — LUKS (Linux Unified Key Setup) full-disk encryption for live disks, shred or blkdiscard on decommission — and save the permission, umask, and patch checks as one dated file.
Attach that dated file as hardening evidence on the asset, naming SC-4 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.