{"data":{"id":"SC-39","name":"Process Isolation","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"Maintain a separate execution domain for each executing system process.","supplemental_guidance":"Systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. Process isolation technologies, including sandboxing or virtualization, logically separate software and firmware from other software, firmware, and data. Process isolation helps limit the access of potentially untrusted software to other system resources. The capability to maintain separate execution domains is available in commercial operating systems that employ multi-state processor technologies.","enhancements":[{"id":"SC-39(01)","name":"Hardware Separation","statement":"Implement hardware separation mechanisms to facilitate process isolation.","baselines":[]},{"id":"SC-39(02)","name":"Separate Execution Domain Per Thread","statement":"Maintain a separate execution domain for each thread in [Assignment: organization-defined multi-threaded processing].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SC-39","name":"Process Isolation","description":"Maintain a separate execution domain for each executing system process.","discussion":"Systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. Process isolation technologies, including sandboxing or virtualization, logically separate software and firmware from other software, firmware, and data. Process isolation helps limit the access of potentially untrusted software to other system resources. The capability to maintain separate execution domains is available in commercial operating systems that employ multi-state processor technologies.","related_controls":["AC-03","AC-04","AC-06","AC-25","SA-08","SC-02","SC-03","SI-16"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"No significant changes from Rev 4."}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["PR.DS-01","PR.DS-10","PR.IR-03"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":[],"rbi_csf":["Annex1.4"],"fisc":["FISC.T14"],"lgpd_bcb":[],"hkma_tme1":["TME1.7.3"],"mlps_2":[],"dnb_good_practice":[],"cra":["CRA.I.2k"],"swift_cscf":["SWIFT.1.3"],"cbb_tm":["TM-8"],"cbuae":["CR-7"],"qatar_nia":["CS"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.2"],"cbe_csf":["CTO-6"],"cbn_csf":["Part3.3"],"sa_js2":["JS2-7.2"],"bot_cyber":["Ch2.4"],"cpmi_pfmi":["CG.PR"],"ecb_croe":["CROE.2.3.5"],"ffiec_is":["II.C.2","II.C.15(a)"],"iosco_cyber":["PROT-2"],"sebi_cscrf":["PR.NS"],"cmmc_2":["SC"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":["Order 887"],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":["FIPS 140-3 §7.6"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":["NDG-9.2"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation through separate address spaces prevents credential-dumping tools from freely accessing the memory of authentication processes, requiring adversaries to circumvent isolation boundaries to extract credentials."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Process isolation limits privilege-escalation exploitation by maintaining separate execution domains, ensuring that exploits in unprivileged processes cannot directly access kernel or privileged process memory."},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation in browsers and client applications contains drive-by compromise exploits within sandboxed processes, preventing exploitation of rendering-engine vulnerabilities from accessing the broader system."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation for public-facing application workers contains exploitation damage by ensuring that compromised application processes cannot directly access other processes' memory or the underlying operating system."},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Process isolation sandboxes client application processes, limiting the impact of exploitation for code execution by preventing exploited document renderers or browsers from accessing other process address spaces."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Process isolation limits exploitation of remote services by ensuring that compromised service processes cannot escape their execution domain to access other processes' memory or resources."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Process isolation maintains separate security and non-security function domains, ensuring that exploitation in application processes cannot directly modify security-enforcement code in isolated security processes."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation protects credential-storage processes by maintaining separate address spaces that prevent exploitation in application processes from directly accessing authentication-service memory."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Process isolation protects authentication processes by maintaining separate execution domains for security functions, making it harder for adversaries to modify authentication libraries or password filters in protected process contexts."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Process isolation is the primary defense against container escape, maintaining separate execution domains between container processes and the host kernel to prevent breakout through process-boundary exploitation."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation with LSASS protection (RunAsPPL/Credential Guard) maintains the LSASS process in a separate, protected execution domain that prevents standard user-mode tools from reading its address space for credential extraction."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation restricts SAM database access by isolating the registry service and SAM access within protected process boundaries that prevent cross-process memory reads by credential-dumping tools."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation on domain controllers protects the NTDS.dit database service by maintaining Active Directory processes in isolated execution domains that resist unauthorized memory access."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation protects LSA secret storage by maintaining the Local Security Authority in a separate, protected execution domain that prevents unauthorized cross-process access to encrypted credential stores."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation restricts access to cached domain credentials by maintaining credential-cache processes in protected execution domains that prevent unauthorized memory reads by dumping tools."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation on domain controllers protects directory replication services by maintaining replication processes in isolated domains, making it harder for adversaries to inject DCSync requests through process manipulation."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation on Linux systems restricts /proc filesystem access between processes, requiring explicit privilege to read other processes' memory maps and preventing casual credential extraction from process address spaces."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Process isolation with proper file-access controls restricts access to /etc/shadow by ensuring that password-file reads require processes running with appropriate privilege levels, not just any user-space process."},{"id":"T1547.002","name":"Authentication Package","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Process isolation protects the LSA authentication pipeline by maintaining authentication packages in isolated execution contexts, preventing unauthorized code from injecting into the authentication process chain."},{"id":"T1547.005","name":"Security Support Provider","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Process isolation protects the Security Support Provider interface by running SSP/AP modules within the protected LSASS process domain, requiring adversaries to bypass isolation to inject credential-intercepting code."},{"id":"T1547.008","name":"LSASS Driver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Process isolation with LSASS protection prevents malicious driver loading into the LSASS process by maintaining the process in a protected execution domain that rejects unsigned or unauthorized driver DLLs."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Process isolation on domain controllers protects the authentication pipeline by isolating authentication-processing components, making it harder for adversaries to inject modified authentication code into domain controller processes."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings from framework-coverage data 2026-10-03: nist_csf_2 PR.DS-01, PR.IR-03 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-029","SP-047"]}}