SC.2.002 — Employ Effective Security Architecture

What SC.2.002 means in plain English

Design your network and systems with security baked in from the start — do not bolt it on later. This means things like defense in depth (multiple layers of protection), least privilege (give the minimum access needed), and keeping CUI systems separated from non-sensitive ones. If you are buying new equipment or setting up a new cloud service, think about how it fits into your security architecture before deploying it. A flat network where everything can talk to everything is a poor architecture.

The assessment question

“Is your network and system architecture designed with security principles such as defense in depth, network segmentation, and least privilege, rather than relying on a single point of protection?”

How to implement SC.2.002

1. Document your current network architecture in a diagram showing all network segments, firewalls, servers, and key workstations. Identify any areas where segmentation is missing.
2. Implement defense in depth: ensure you have protection at multiple layers — perimeter firewall, host-based firewall on each machine, endpoint antivirus, email filtering, and network monitoring.
3. Segment your network so CUI systems are on a dedicated VLAN that only authorized users and services can reach. Do not mix CUI workstations with general-purpose devices on the same flat network.
4. Apply least privilege to network services: disable unnecessary ports and services on all systems, remove default accounts, and ensure service accounts have minimum required permissions.
5. Review architecture whenever you add new systems or services. Document any architectural decisions and their security rationale.

Evidence your assessor will ask for

• Network architecture diagram showing defense-in-depth layers and segmentation
• Documentation of security architecture design principles applied to the environment
• Evidence of multiple protection layers (firewall, endpoint, email, network)
• System hardening documentation or CIS Benchmark compliance evidence
• Architecture review records showing security was considered for new systems

More System and Communications Protection controls