Skip to main content

πŸ’Ό PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

  • Contextual name: πŸ’Ό PR.IR-01: Networks and environments are protected from unauthorized logical access and usage
  • ID: /frameworks/nist-csf-v2.0/pr-ir/01
  • Located in: πŸ’Ό Technology Infrastructure Resilience (PR.IR)

Description​

  1. Logically segment organization networks and cloud-based platforms according to trust boundaries and platform types (e.g., IT, IoT, OT, mobile, guests), and permit required communications only between segments
  2. Logically segment organization networks from external networks, and permit only necessary communications to enter the organization's networks from the external networks
  3. Implement zero trust architectures to restrict network access to each resource to the minimum necessary
  4. Check the cyber health of endpoints before allowing them to access and use production resources

Similar​

  • Sections
    • /frameworks/nist-csf-v1.1/pr-ac/03
    • /frameworks/nist-csf-v1.1/pr-ac/05
    • /frameworks/nist-csf-v1.1/pr-ds/07
    • /frameworks/nist-csf-v1.1/pr-pt/04
    • /frameworks/nist-sp-800-53-r5/ac/03
    • /frameworks/nist-sp-800-53-r5/ac/04
    • /frameworks/nist-sp-800-53-r5/sc/04
    • /frameworks/nist-sp-800-53-r5/sc/05
    • /frameworks/nist-sp-800-53-r5/sc/07

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.AC-3: Remote access is managed
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation)713
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.DS-7: The development and testing environment(s) are separate from the production environment1
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.PT-4: Communications and control networks are protected713
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό AC-3 Access Enforcement15417
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό AC-4 Information Flow Enforcement326173
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-4 Information in Shared System Resources2
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-5 Denial-of-service Protection32
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-7 Boundary Protection29533

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (40)​

PolicyLogic CountFlags
πŸ“ AWS Account Object-level CloudTrail Logging for Read Events for S3 Buckets is not enabled 🟒1🟒 x6
πŸ“ AWS Account Object-level CloudTrail Logging for Write Events for S3 Buckets is not enabled 🟒1🟒 x6
πŸ“ AWS API Gateway API Route Authorization Type is not configured 🟒1🟒 x6
πŸ“ AWS API Gateway REST API Stage is not configured to use an SSL certificate for authentication 🟒1🟒 x6
πŸ“ AWS EC2 Default Security Group does not restrict all traffic 🟒1🟒 x6
πŸ“ AWS EC2 Instance IMDSv2 is not enabled 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted CIFS traffic 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted FTP traffic 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted RPC traffic 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted SMTP traffic 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted traffic to MongoDB 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted traffic to MSSQL 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted traffic to MySQL 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted traffic to PostgreSQL 🟒1🟒 x6
πŸ“ AWS EC2 Security Group allows unrestricted Telnet traffic 🟒1🟒 x6
πŸ“ AWS IAM Policy allows full administrative privileges 🟒1🟒 x6
πŸ“ AWS IAM User has inline or directly attached policies 🟒1🟠 x1, 🟒 x5
πŸ“ AWS IAM User with credentials unused for 45 days or more is not disabled 🟒1🟒 x6
πŸ“ AWS RDS Instance is publicly accessible and in an unrestricted public subnet 🟒1🟒 x6
πŸ“ AWS RDS Instance uses default endpoint port 🟒1🟒 x6
πŸ“ AWS RDS Snapshot is publicly accessible 🟒1🟒 x6
πŸ“ AWS S3 Bucket is not configured to block public access 🟒1🟒 x6
πŸ“ AWS S3 Bucket Object Lock is not enabled 🟠🟒1🟠 x1, 🟒 x6
πŸ“ AWS S3 Bucket Policy is not set to deny HTTP requests 🟒1🟒 x6
πŸ“ AWS S3 Bucket Versioning is not enabled 🟒1🟒 x6
πŸ“ AWS VPC Network ACL exposes admin ports to public internet ports 🟒1🟒 x6
πŸ“ Azure App Service Authentication is disabled and Basic Authentication is enabled 🟒1🟒 x6
πŸ“ Azure App Service Basic Authentication is enabled 🟒🟒 x3
πŸ“ Azure App Service FTP deployments are not disabled 🟒1🟒 x6
πŸ“ Azure App Service HTTPS Only configuration is not enabled 🟒1🟒 x6
πŸ“ Azure MySQL Flexible Server require_secure_transport Parameter is not set to ON 🟒1🟒 x6
πŸ“ Azure PostgreSQL Flexible Server require_secure_transport Parameter is not set to ON 🟒1🟒 x6
πŸ“ Azure PostgreSQL Single Server Enforce SSL Connection is not set enabled 🟒1🟒 x6
πŸ“ Azure PostgreSQL Single Server Infrastructure Double Encryption is not enabled 🟒1🟒 x6
πŸ“ Azure Storage Account Cross Tenant Replication is enabled 🟒1🟒 x6
πŸ“ Azure Storage Account Secure Transfer Required is not enabled 🟒1🟒 x6
πŸ“ Azure Subscription Network Watcher is not enabled in every available region 🟒1πŸ”΄ x1, 🟒 x5