Make sure one user or process can't read leftover CUI from shared memory, cache, or storage.
What it actually means
Shared system resources — memory, cache, temporary storage — shouldn't let information leak from one user or process to another. On modern, supported operating systems this is largely handled by built-in object-reuse protections, so the practical task is to run current, patched operating systems and not disable those protections.
Pass or fail — an assessor needs a "yes" to each
- Are you running current, supported operating systems that clear or zero reused resources by default?
- Have you avoided configurations that disable object-reuse / memory-protection features?
What to have ready
- OS inventory showing supported, patched versions
- Baseline configuration confirming memory / object-reuse protections aren't disabled
Where teams trip up
- Running end-of-life operating systems that lack modern object-reuse protections
- Assuming it's 'automatic' without documenting that you rely on the OS for it
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →Connected requirements
More in System & Communications Protection (3.13)
3.13.1 — Protect your boundaries3.13.2 — Build security in by design3.13.3 — Separate user and admin functions3.13.5 — Wall off your public-facing systems3.13.6 — Deny all, permit by exception3.13.7 — Block split tunneling on VPNs3.13.8 — Encrypt CUI in transit3.13.9 — Drop idle network sessions3.13.10 — Manage your encryption keys3.13.11 — FIPS-validated cryptography3.13.12 — Control cameras and microphones3.13.13 — Control mobile code3.13.14 — Control and monitor VoIP3.13.15 — Protect session authenticity3.13.16 — Encrypt CUI at rest