NIST 800-53 REV 5 • SYSTEM AND COMMUNICATIONS PROTECTION
SC-49 — Hardware-enforced Separation and Policy Enforcement
Implement hardware-enforced separation and policy enforcement mechanisms between {{ insert: param, sc-49_odp }}.
Supplemental Guidance
System owners may require additional strength of mechanism and robustness to ensure domain separation and policy enforcement for specific types of threats and environments of operation. Hardware-enforced separation and policy enforcement provide greater strength of mechanism than software-enforced separation and policy enforcement.
Practitioner Notes
Use hardware-enforced separation and policy enforcement — where the CPU or dedicated hardware enforces security boundaries that software alone cannot bypass.
Example 1: Deploy systems with AMD SEV (Secure Encrypted Virtualization) or Intel TDX (Trust Domain Extensions) that use the CPU to encrypt each VM's memory with a unique key. Even the hypervisor cannot read a VM's memory, providing hardware-enforced isolation between tenants.
Example 2: Use ARM TrustZone on mobile and IoT devices to create a hardware-isolated "secure world" for processing sensitive data. The secure world runs a separate OS that handles cryptographic operations, while the normal world runs the user-facing applications.