---
name: framework-financial-services-controls-sc-2
title: SC-2 - Separation of System and User Functionality
description: Separate user functionality, including user interface services, from system management functionality.
last-updated: 2025-02-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services-controls?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# SC-2 - Separation of System and User Functionality
{: #sc-2}

## Control requirements
{: #control-requirements}



### SC-2 - 0


Separate user functionality, including user interface services, from system management functionality.






## Additional IBM Cloud for Financial Services specifications
{: #additional-ibm-cloud-for-financial-services-specifications}

Container Security Requirements: 
• The management plane traffic must be separated from data plane traffic.




## Implementation guidance
{: #implementation-guidance}

See the resources that follow to learn more about how to implement this control.


- [Ensuring isolation between Satellite management functions and workload functions](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-management-isolation&format=markdown)


- [Creating and connecting the management and workload VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-create-vpcs&format=markdown)






## NIST supplemental guidance
{: #nist-supplemental-guidance}

System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in SA-8, including SA-8(1), SA-8(3), SA-8(4), SA-8(10), SA-8(12), SA-8(13), SA-8(14), and SA-8(18).