# SC-7(4) — External Telecommunications Services

- **Control ID:** SC-7(4)
- **Family:** [SC](/md/families/SC.md)
- **Baselines:** moderate, high
- **Enhancement of:** [SC-7](/md/controls/SC-7.md)

## Description

Implement a managed interface for each external telecommunication service; Establish a traffic flow policy for each managed interface; Protect the confidentiality and integrity of the information being transmitted across each interface; Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need; Review exceptions to the traffic flow policy \[assignment\] and remove exceptions that are no longer supported by an explicit mission or business need; Prevent unauthorized exchange of control plane traffic with external networks; Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and Filter unauthorized control plane traffic from external networks.

## Discussion

External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic include Border Gateway Protocol (BGP) routing, Domain Name System (DNS), and management protocols. See \[SP 800-189\](\#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

No content available.

## Related controls

- [AC-3](/md/controls/AC-3.md)
- [SC-8](/md/controls/SC-8.md)
- [SC-20](/md/controls/SC-20.md)
- [SC-21](/md/controls/SC-21.md)
- [SC-22](/md/controls/SC-22.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.