SC-7 (4) - External Telecommunications Services

Control requirements

The organization:

SC-7 (4) (a): Implements a managed interface for each external telecommunication service;
SC-7 (4) (b): Establishes a traffic flow policy for each managed interface;
SC-7 (4) (c): Protects the confidentiality and integrity of the information being transmitted across each interface;
SC-7 (4) (d): Documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and
SC-7 (4) (e): Reviews exceptions to the traffic flow policy [IBM Assignment: at least annually] and removes exceptions that are no longer supported by an explicit mission/business need.

See the resources that follow to learn more about how to implement this control.