NIST 800-171 Controls · System and Communications Protection

SC.2.004 — Prevent Unauthorized Info Transfer via Shared Resources

CMMC Level 2SPRS if unmet: -1LOW priority~4h to implement

Prevent unauthorized and unintended information transfer via shared system resources.

What SC.2.004 means in plain English

When multiple users share a computer or system, make sure one person's data does not leak to another. Clear clipboard data, temporary files, and browser caches between user sessions. If you use shared workstations, each user should have their own Windows profile. Disable features like shared clipboard in remote desktop sessions if they are not needed. The goal is to prevent CUI from accidentally ending up where it should not be.

The assessment question

“Do you take measures to prevent CUI from leaking between users through shared system resources such as temporary files, clipboard data, shared workstations, and browser caches?”

How to implement SC.2.004

Ensure every user on shared workstations has their own Windows user profile — no shared "shop" logins. Each profile isolates temporary files, downloads, and browser data.
Configure Group Policy to clear the paging file on shutdown: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > "Shutdown: Clear virtual memory pagefile" set to Enabled.
Disable clipboard redirection in Remote Desktop if users RDP into shared servers: Group Policy > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Device and Resource Redirection > "Do not allow clipboard redirection."
Set browsers to clear cache, cookies, and download history on exit for shared workstations.

Evidence your assessor will ask for

Group Policy settings showing virtual memory pagefile is cleared on shutdown
Evidence that shared workstations use individual user profiles (not shared accounts)
Remote Desktop clipboard redirection policy configuration (if applicable)
Browser configuration showing cache clearing on exit for shared workstations

Does AI prompt monitoring help with this control? Honestly, no.

SC.2.004 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Communications Protection controls

SC.1.001

Monitor and Protect Communications at Boundaries

SC.1.005

Implement Subnetworks for Public Components

SC.2.002

Employ Effective Security Architecture

SC.2.003

Separate User and System Management Functionality

SC.2.006

Deny Network Traffic by Default

SC.2.007

Prevent Remote Device Split Tunneling

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment