STIGhub
STIGs
RMF Controls
Compare
← SC-39 — Process Isolation
CCI-002530
Definition
Maintain a separate execution domain for each executing system process.
Parent Control
SC-39
Process Isolation
System and Communications Protection
Linked STIG Checks (56)
V-213117
CAT II
Adobe Acrobat Pro DC Continuous Enhanced Security for standalone mode must be enabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-213118
CAT II
Adobe Acrobat Pro DC Continuous Enhanced Security for browser mode must be enabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-213127
CAT II
Adobe Acrobat Pro DC Continuous Protected Mode must be enabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-213128
CAT II
Adobe Acrobat Pro DC Continuous Protected View must be enabled.
Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide
V-254601
CAT II
Apple iOS/iPadOS 16 must not allow non-DoD applications to access DoD data.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-250942
CAT II
Apple iOS/iPadOS 15 must not allow non-DoD applications to access DoD data.
Apple iOS/iPadOS 15 Security Technical Implementation Guide
V-257118
CAT II
Apple iOS/iPadOS 16 must not allow non-DOD applications to access DOD data.
Apple iOS/iPadOS 16 BYOAD Security Technical Implementation Guide
V-257134
CAT II
Apple iOS/iPadOS 16 must not allow DOD applications to access non-DOD data.
Apple iOS/iPadOS 16 BYOAD Security Technical Implementation Guide
V-259775
CAT II
Apple iOS/iPadOS 17 must not allow non-DOD applications to access DOD data.
Apple iOS/iPadOS 17 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-259794
CAT II
Apple iOS/iPadOS 17 must not allow DOD applications to access non-DOD data.
Apple iOS/iPadOS 17 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-258333
CAT II
Apple iOS/iPadOS 17 must not allow non-DOD applications to access DOD data.
Apple iOS/iPadOS 17 Security Technical Implementation Guide
V-268017
CAT II
Apple iOS/iPadOS 18 must not allow non-DOD applications to access DOD data.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-278777
CAT II
Apple iOS/iPadOS 26 must not allow non-DOD applications to access DOD data.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-276388
CAT II
Apple visionOS 2 must not allow non-DOD applications to access DOD data.
Apple visionOS 2 Security Technical Implementation Guide
V-282797
CAT II
Apple visionOS 26 must not allow non-DOD applications to access DOD data.
Apple visionOS 26 Security Technical Implementation Guide
V-222591
CAT II
The application must maintain a separate execution domain for each executing process.
Application Security and Development Security Technical Implementation Guide
V-237340
CAT II
The ArcGIS Server must maintain a separate execution domain for each executing process.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-251642
CAT II
CA IDMS must protect the system code and storage from corruption by user programs.
CA IDMS Security Technical Implementation Guide
V-251643
CAT II
CA IDMS must protect system and user code and storage from corruption by user programs.
CA IDMS Security Technical Implementation Guide
V-251644
CAT II
CA IDMS must prevent user code from issuing selected SVC privileged functions.
CA IDMS Security Technical Implementation Guide
V-233221
CAT II
The container platform runtime must maintain separate execution domains for each container by assigning each container a separate address space.
Container Platform Security Requirements Guide
V-206606
CAT II
The DBMS must maintain a separate execution domain for each executing process.
Database Security Requirements Guide
V-258487
CAT II
Google Android 13 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Google Android 13 BYOAD Security Technical Implementation Guide
V-258425
CAT II
Google Android 14 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Google Android 14 COPE Security Technical Implementation Guide
V-260152
CAT II
Google Android 14 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Google Android 14 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-267543
CAT II
Google Android 15 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Google Android 15 COPE Security Technical Implementation Guide
V-276868
CAT II
Google Android 16 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Google Android 16 COPE Security Technical Implementation Guide
V-274404
CAT II
Honeywell Android 13 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Honeywell Android 13 COPE Security Technical Implementation Guide
V-213991
CAT II
SQL Server must maintain a separate execution domain for each executing process.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-213992
CAT II
SQL Server services must be configured to run under unique dedicated user accounts.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205586
CAT II
The Mainframe Product must maintain a separate execution domain for each executing process.
Mainframe Product Security Requirements Guide
V-276311
CAT II
Azure SQL Managed Instance must maintain a separate execution domain for each executing process.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-225233
CAT II
Trust must be established prior to enabling the loading of remote code in .Net 4.
Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
V-225236
CAT II
Software utilizing .Net 4.0 must be identified and relevant access controls configured.
Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
V-221257
CAT II
Exchange software must be installed on a separate partition from the OS.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-228405
CAT II
The Exchange Email application must not share a partition with another application.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259637
CAT II
Exchange software must be installed on a separate partition from the OS.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259704
CAT II
The Exchange email application must not share a partition with another application.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-271358
CAT II
SQL Server services must be configured to run under unique dedicated user accounts.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-271359
CAT II
SQL Server must maintain a separate execution domain for each executing process.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-260925
CAT II
CPU priority must be set appropriately on all containers.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-260935
CAT II
Host IPC namespace must not be shared.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-272336
CAT II
Motorola Solutions Android 13 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Motorola Solutions Android 13 COPE Security Technical Implementation Guide
V-253547
CAT II
Prisma Cloud Compute must run within a defined/separate namespace (e.g., Twistlock).
Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide
V-254570
CAT II
Rancher RKE2 runtime must maintain separate execution domains for each container by assigning each container a separate address space to prevent unauthorized and unintended information transfer via shared system resources.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-260453
CAT II
Samsung Android's Work profile must be configured to disable exceptions to the access control policy that prevent application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes.
Samsung Android 14 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-272602
CAT II
Samsung Android's Work profile must be configured to disable exceptions to the access control policy that prevent application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes.
Samsung Android 15 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-276646
CAT II
Samsung Android's Work profile must be configured to disable exceptions to the access control policy that prevent application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes.
Samsung Android 16 COPE Security Technical Implementation Guide
V-255160
CAT II
Samsung Android's Work profile must be configured to disable exceptions to the access control policy that prevent application processes, and groups of application processes from accessing all data stored by other application processes, and groups of application processes.
Samsung Android OS 13 with Knox 3.x COPE Security Technical Implementation Guide
V-258686
CAT II
Samsung Android's Work profile must be configured to disable exceptions to the access control policy that prevent application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes.
Samsung Android OS 14 with Knox 3.x COPE Security Technical Implementation Guide
V-269052
CAT II
Samsung Android's Work profile must be configured to disable exceptions to the access control policy that prevent application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes.
Samsung Android OS 15 with Knox 3.x COPE Security Technical Implementation Guide
V-241167
CAT II
Trend Deep Security must maintain a separate execution domain for each executing process.
Trend Micro Deep Security 9.x Security Technical Implementation Guide
V-207496
CAT II
The VMM must maintain a separate execution domain for each executing process.
Virtual Machine Manager Security Requirements Guide
V-207497
CAT II
The VMM must maintain a separate execution domain for each guest VM.
Virtual Machine Manager Security Requirements Guide
V-270150
CAT II
Zebra Android 13 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Zebra Android 13 COPE Security Technical Implementation Guide
V-283635
CAT II
Zebra Android 14 must be configured to disable exceptions to the access control policy that prevent [selection: application processes, groups of application processes] from accessing [selection: all, private] data stored by other [selection: application processes, groups of application processes].
Zebra Technologies Android 14 COPE Security Technical Implementation Guide