SC.L2-3.13.3Role Separation
Separate user functionality from system management functionality.
[a]
user functionality is identified;[b]
system management functionality is identified; and[c]
user functionality is separated from system management functionality.
Management interfaces unreachable from user devices; admin work happens on a separate plane
Implementation
AO coverage. Addresses all three Role Separation objectives: identifying user functionality, identifying system management functionality, and separating the two.
User functionality identified [a]. Email, Office apps, the labeled CUI file shares, the MRP client, and CAD. All of it is reachable from a standard user account on a managed endpoint on the office or enclave VLAN.
System management functionality identified [b]. Hypervisor and storage consoles, switch and firewall management, the file server's administrative shares, backup console, Microsoft 365 admin centers, and the certificate authority. These are enumerated in a one-page list so “is this a management interface?” is not a judgment call.
Separation [c]. Every interface on the management list is reachable only from the management VLAN, which is entered through a single jump host requiring a privileged account with phishing-resistant MFA. Standard accounts cannot authenticate to those consoles at all. The three IT staff each have two accounts: a normal one with a mailbox for daily work, and a privileged one with no mailbox that exists only for management. Cloud admin centers are gated by a Conditional Access policy scoped to the privileged accounts and the jump host's egress address, and admins use a dedicated browser profile so a session cookie from casual browsing cannot be reused against an admin center.
Presentation separation. The file server exposes user shares over SMB on the enclave VLAN while its management interfaces are bound to the management NIC only. Hypervisor guests never share a virtual switch with the management network.
Maintenance. Quarterly test from a standard user device: attempt each interface on the management list and record the failure. The management-interface list is reviewed whenever a new appliance is bought, because an unlisted console is the usual way this control decays.
Accepted gap. One older backup appliance offers only a single combined web interface for both restore requests and appliance administration. Restore requests are handled by IT on the user's behalf rather than exposing the interface, and the appliance stays management-VLAN only until it is replaced.
What the evidence looks like
- Enumerated list of user-facing versus management interfaces
- Network ACL / VLAN configuration showing management interfaces reachable only from the jump path
- Conditional Access policy scoping cloud admin centers to privileged accounts
- Account inventory showing paired standard and privileged accounts for IT staff
- Quarterly separation test results from a standard user device
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.