Prevent Unauthorized and Unintended Information Transfer

SC.L2-3.13.4 requires organizations to prevent unauthorized and unintended information transfer through shared system resources, including memory, storage, CPU caches, temporary files, swap space, and inter-process communication channels. Grounded in NIST SP 800-171 Rev 2 §3.13.4, this practice targets the risk that residual data left in shared resources by one process or user could be read by a subsequent process or user that receives the same resource allocation. For most small and mid-size defense contractors, compliance centers on ensuring operating systems zero memory on deallocation, restricting permissions on shared directories and temporary file locations, clearing session data on termination, and isolating user profiles on shared workstations. In cloud and virtualized environments, the organization must verify that the hosting provider enforces tenant isolation through FedRAMP authorization or equivalent documentation.