NIST 800-53 REV 5 • SYSTEM AND COMMUNICATIONS PROTECTION
SC-3(1) — Hardware Separation
Employ hardware separation mechanisms to implement security function isolation.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
Hardware separation mechanisms include hardware ring architectures that are implemented within microprocessors and hardware-enforced address segmentation used to support logically distinct storage objects with separate attributes (i.e., readable, writeable).
Practitioner Notes
This enhancement requires using physical hardware separation to isolate security functions, not just software-based isolation. The idea is that hardware boundaries are much harder to bypass than software boundaries.
Example 1: Use a Hardware Security Module (HSM) to handle all cryptographic key operations. The HSM is a physically separate device that processes encryption and signing operations in tamper-resistant hardware — keys never leave the device.
Example 2: Enable Intel TXT (Trusted Execution Technology) or AMD SEV on your servers to create hardware-enforced memory regions where security functions execute. The CPU hardware itself prevents other processes from reading or modifying that protected memory.