SC-39 is one sentence long. Maintain a separate execution domain for each executing system process. In NIST's words, the usual way is to give each process its own address space, so processes talk to each other only through controlled functions and one process cannot change the code another is running.
800-53 binds US federal systems and, through contracts, their suppliers. For a small or mid size company it is a reference for answering a customer who asks how workloads are kept apart.
What it means in practice
Modern operating systems already give every process a private address space. The control becomes interesting when you run untrusted code: customer workloads, plugins, build jobs, or third party agents. NIST names sandboxing and virtualization as process isolation technologies that logically separate software and data from other software and data.
Two enhancements raise the bar. SC-39(1), Hardware Separation, uses hardware features to enforce isolation. SC-39(2), Separate Execution Domain Per Thread, extends the idea to threads.
Evidence to collect
- An architecture note stating which isolation mechanism protects which workload: OS process model, container, virtual machine or sandbox.
- Container runtime and orchestrator configuration showing no shared process namespace and no privileged containers where not needed.
- Hypervisor or cloud instance configuration for workloads that need stronger separation.
- A list of exceptions with an owner and reason.
Common gaps
Privileged containers and host path mounts that quietly remove the boundary. Build runners that execute code from many repositories on one long lived host. Teams that assume isolation without ever checking the runtime flags.
How to implement it
Decide your trust levels first. Code you wrote and reviewed can share a host. Code you did not should run in a sandbox or its own virtual machine. Then enforce it with defaults: unprivileged containers, read only file systems, and separate runners for untrusted jobs. Export the configuration on a schedule so you always have current evidence.
Quick check
Does SC-39 require special hardware?
No. Separate address spaces in a normal operating system meet the base control. Hardware separation is the enhancement SC-39(1).
