Shared Resource Control

Official Source Material

Prevent unauthorized and unintended information transfer via shared system resources.

Determine if:

[a] unauthorized and unintended information transfer via shared system resources is prevented.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

This is an operating system property, not a file share setting.

The requirement targets leftover information in shared resources: memory, cache, and disk space reclaimed from one user and handed to another. A current, supported operating system provides the protection. Your work is proving you run current systems configured to keep it.

Evidence is the inventory plus the baseline.

Show supported operating system versions across the fleet, and users without administrative rights so they cannot read other users' profiles. Add the platform memory protections enabled in your baseline, such as kernel DMA protection and core isolation. A configuration report tying those settings to your endpoints answers [a].

Do not chase processor-level scenarios.

Side-channel and processor cache attacks are handled by the patching and flaw remediation you already run under SI.L2-3.14.1. The cases that matter here are shared computers and terminal servers where users can save files outside their own profile. Lock the public locations down.

What falls short

A system security plan paragraph about least privilege and folder permissions. Access control governs authorized reads. Objective [a] is about information left behind in resources the system reuses, and the answer lives in the operating system and its configuration.

Edge cases

Terminal servers and shared workstations are where this requirement becomes visible. Redirect profiles, restrict public folders, and keep users out of each other's directories, because a shared host is one misconfigured folder away from unintended transfer.