Showing 410 controls
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] access c...
Concurrent Session Control
Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number].
Device Lock
a. Prevent further access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a devic...
Device Lock | Pattern-hiding Displays
Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Session Termination
Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].
Permitted Actions Without Identification or Authentication
a. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions;...
Remote Access
a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to...
Remote Access | Monitoring and Control
Employ automated mechanisms to monitor and control remote access methods.
Remote Access | Protection of Confidentiality and Integrity Using Encryption
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Remote Access | Managed Access Control Points
Route remote accesses through authorized and managed network access control points.
Remote Access | Privileged Commands and Access
(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assig...
Wireless Access
a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior to al...
Wireless Access | Authentication and Encryption
Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
Wireless Access | Disable Wireless Networking
Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
Wireless Access | Restrict Configurations by Users
Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
Wireless Access | Antennas and Transmission Power Levels
Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
Access Control for Mobile Devices
a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas;...
Access Control for Mobile Devices | Full Device or Container-based Encryption
Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].
Account Management
a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: organization-defined prerequisites and...
Account Management | Automated System Account Management
Support the management of system accounts using [Assignment: organization-defined automated mechanisms].
Account Management | Usage Conditions
Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].
Account Management | Account Monitoring for Atypical Usage
(a) Monitor system accounts for [Assignment: organization-defined atypical usage]; and (b) Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].
Account Management | Disable Accounts for High-risk Individuals
Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].
Account Management | Automated Temporary and Emergency Account Management
Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].
Account Management | Disable Accounts
Disable accounts within [Assignment: organization-defined time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organiza...
Account Management | Automated Audit Actions
Automatically audit account creation, modification, enabling, disabling, and removal actions.
Account Management | Inactivity Logout
Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].
Account Management | Privileged User Accounts
(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignmen...
Account Management | Restrictions on Use of Shared and Group Accounts
Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions for establishing shared and group accounts].
Use of External Systems
a. [Selection (one or more): Establish [Assignment: organization-defined terms and conditions]; Identify [Assignment: organization-defined controls asserted to be implemented on external systems]], co...
Use of External Systems | Limits on Authorized Use
Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementation o...
Use of External Systems | Portable Storage Devices — Restricted Use
Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].
Information Sharing
a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: organization-defined informatio...
Publicly Accessible Content
a. Designate individuals authorized to make information publicly accessible; b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c....
Access Enforcement
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Information Flow Enforcement
Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].
Information Flow Enforcement | Physical or Logical Separation of Information Flows
Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types o...
Information Flow Enforcement | Flow Control of Encrypted Information
Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the en...
Separation of Duties
a. Identify and document [Assignment: organization-defined duties of individuals requiring separation]; and b. Define system access authorizations to support separation of duties.
Least Privilege
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Least Privilege | Authorize Access to Security Functions
Authorize access for [Assignment: organization-defined individuals or roles] to: (a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]; and (b) [As...
Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
Prevent non-privileged users from executing privileged functions.
Least Privilege | Non-privileged Access for Nonsecurity Functions
Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when access...
Least Privilege | Network Access to Privileged Commands
Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access i...
Least Privilege | Privileged Accounts
Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].
Least Privilege | Review of User Privileges
(a) Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and (b) Reas...
Least Privilege | Privilege Levels for Code Execution
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: organization-defined software].
Least Privilege | Log Use of Privileged Functions
Log the execution of privileged functions.
Unsuccessful Logon Attempts
a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; and b. Automatically [Selection (...
System Use Notification
a. Display [Assignment: organization-defined system use notification message or banner] to users before granting access to the system that provides privacy and security notices consistent with applica...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] audit an...
Non-repudiation
Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation].
Audit Record Retention
Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulator...
Audit Record Generation
a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components]; b. Allow [Assignment:...
Audit Record Generation | System-wide and Time-correlated Audit Trail
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined...
Audit Record Generation | Changes by Authorized Individuals
Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on...
Event Logging
a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging]; b. Coordi...
Content of Audit Records
Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. O...
Content of Audit Records | Additional Audit Information
Generate audit records containing the following additional information: [Assignment: organization-defined additional information].
Audit Log Storage Capacity
Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].
Response to Audit Logging Process Failures
a. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure; and b. Take the following additi...
Response to Audit Logging Process Failures | Storage Capacity Warning
Provide a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assign...
Response to Audit Logging Process Failures | Real-time Alerts
Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Ass...
Audit Record Review, Analysis, and Reporting
a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact...
Audit Record Review, Analysis, and Reporting | Automated Process Integration
Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].
Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
Audit Record Review, Analysis, and Reporting | Central Review and Analysis
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records
Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined da...
Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity...
Audit Record Review, Analysis, and Reporting | Permitted Actions
Specify the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information.
Audit Record Reduction and Report Generation
Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigation...
Audit Record Reduction and Report Generation | Automatic Processing
Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].
Time Stamps
a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and t...
Protection of Audit Information
a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [Assignment: organization-defined personnel or roles] upon detection of unautho...
Protection of Audit Information | Store on Separate Physical Systems or Components
Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
Protection of Audit Information | Cryptographic Protection
Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
Protection of Audit Information | Access by Subset of Privileged Users
Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] awarenes...
Literacy Training and Awareness
a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-...
Literacy Training and Awareness | Insider Threat
Provide literacy training on recognizing and reporting potential indicators of insider threat.
Literacy Training and Awareness | Social Engineering and Mining
Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
Role-based Training
a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: 1. Before authorizing ac...
Training Records
a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b. Retain in...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] configur...
Software Usage Restrictions
a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to con...
User-installed Software
a. Establish [Assignment: organization-defined policies] governing the installation of software by users; b. Enforce software installation policies through the following methods: [Assignment: organiz...
Information Location
a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; b. Identify and document t...
Information Location | Automated Tools to Support Information Location
Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect or...
Signed Components
Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized...
Baseline Configuration
a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: org...
Baseline Configuration | Automation Support for Accuracy and Currency
Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].
Baseline Configuration | Retention of Previous Configurations
Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.
Baseline Configuration | Configure Systems and Components for High-risk Areas
(a) Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to b...
Configuration Change Control
a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such change...
Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes
Use [Assignment: organization-defined automated mechanisms] to: (a) Document proposed changes to the system; (b) Notify [Assignment: organization-defined approval authorities] of proposed changes to...
Configuration Change Control | Testing, Validation, and Documentation of Changes
Test, validate, and document changes to the system before finalizing the implementation of the changes.
Configuration Change Control | Security and Privacy Representatives
Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element].
Configuration Change Control | Cryptography Management
Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls].
Impact Analyses
Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
Impact Analyses | Separate Test Environments
Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or...
Impact Analyses | Verification of Controls
After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements...
Access Restrictions for Change
Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
Access Restrictions for Change | Automated Access Enforcement and Audit Records
(a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions.
Access Restrictions for Change | Privilege Limitation for Production and Operation
(a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment: organization-def...
Configuration Settings
a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organizati...
Configuration Settings | Automated Management, Application, and Verification
Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms].
Configuration Settings | Respond to Unauthorized Changes
Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions].
Least Functionality
a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and b. Prohibit or restrict the use of the following functions, ports, protocols, software,...
Least Functionality | Periodic Review
(a) Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [Assignment...
Least Functionality | Prevent Program Execution
Prevent program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and rest...
Least Functionality | Authorized Software — Allow-by-exception
(a) Identify [Assignment: organization-defined software programs authorized to execute on the system]; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software...
System Component Inventory
a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of componen...
System Component Inventory | Updates During Installation and Removal
Update the inventory of system components as part of component installations, removals, and system updates.
System Component Inventory | Automated Maintenance
Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].
System Component Inventory | Automated Unauthorized Component Detection
(a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined f...
System Component Inventory | Accountability Information
Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible and accountable for administering those compo...
Configuration Management Plan
Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a pr...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] continge...
System Recovery and Reconstitution
Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a dis...
System Recovery and Reconstitution | Transaction Recovery
Implement transaction recovery for systems that are transaction-based.
System Recovery and Reconstitution | Restore Within Time Period
Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a...
Contingency Plan
a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priori...
Contingency Plan | Coordinate with Related Plans
Coordinate contingency plan development with organizational elements responsible for related plans.
Contingency Plan | Capacity Planning
Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
Contingency Plan | Resume Mission and Business Functions
Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: organization-defined time period] of contingency plan activation.
Contingency Plan | Continue Mission and Business Functions
Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at p...
Contingency Plan | Identify Critical Assets
Identify critical system assets supporting [Selection: all; essential] mission and business functions.
Contingency Training
a. Provide contingency training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming a contingency role or respon...
Contingency Training | Simulated Events
Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.
Contingency Plan Testing
a. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [As...
Contingency Plan Testing | Coordinate with Related Plans
Coordinate contingency plan testing with organizational elements responsible for related plans.
Contingency Plan Testing | Alternate Processing Site
Test the contingency plan at the alternate processing site: (a) To familiarize contingency personnel with the facility and available resources; and (b) To evaluate the capabilities of the alternate...
Alternate Storage Site
a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides control...
Alternate Storage Site | Separation from Primary Site
Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.
Alternate Storage Site | Recovery Time and Recovery Point Objectives
Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
Alternate Storage Site | Accessibility
Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.
Alternate Processing Site
a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and busine...
Alternate Processing Site | Separation from Primary Site
Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.
Alternate Processing Site | Accessibility
Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
Alternate Processing Site | Priority of Service
Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
Alternate Processing Site | Preparation for Use
Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions.
Telecommunications Services
Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business func...
Telecommunications Services | Priority of Service Provisions
(a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives);...
Telecommunications Services | Single Points of Failure
Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
Telecommunications Services | Separation of Primary and Alternate Providers
Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
Telecommunications Services | Provider Contingency Plan
(a) Require primary and alternate telecommunications service providers to have contingency plans; (b) Review provider contingency plans to ensure that the plans meet organizational contingency requi...
System Backup
a. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency consistent with recovery time and recovery po...
System Backup | Testing for Reliability and Integrity
Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.
System Backup | Test Restoration Using Sampling
Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.
System Backup | Separate Storage for Critical Information
Store backup copies of [Assignment: organization-defined critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated wit...
System Backup | Transfer to Alternate Storage Site
Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives].
System Backup | Cryptographic Protection
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] identifi...
Re-authentication
Require users to re-authenticate when [Assignment: organization-defined circumstances or situations requiring re-authentication].
Identity Proofing
a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve...
Identity Proofing | Identity Evidence
Require evidence of individual identification be presented to the registration authority.
Identity Proofing | Identity Evidence Validation and Verification
Require that the presented identity evidence be validated and verified through [Assignment: organizational defined methods of validation and verification].
Identity Proofing | In-person Validation and Verification
Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
Identity Proofing | Address Confirmation
Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
Identification and Authentication (organizational Users)
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts
Implement multi-factor authentication for access to privileged accounts.
Identification and Authentication (organizational Users) | Acceptance of PIV Credentials
Accept and electronically verify Personal Identity Verification-compliant credentials.
Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts
Implement multi-factor authentication for access to non-privileged accounts.
Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication
When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
Identification and Authentication (organizational Users) | Access to Accounts —separate Device
Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the...
Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant
Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].
Device Identification and Authentication
Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.
Identifier Management
Manage system identifiers by: a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier; b. Selecting...
Identifier Management | Identify User Status
Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status].
Authenticator Management
Manage system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b. Esta...
Authenticator Management | Password-based Authentication
For password-based authentication: (a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational pa...
Authenticator Management | Expiration of Cached Authenticators
Prohibit the use of cached authenticators after [Assignment: organization-defined time period].
Authenticator Management | Public Key-based Authentication
(a) For public key-based authentication: (1) Enforce authorized access to the corresponding private key; and (2) Map the authenticated identity to the account of the individual or group; and (b) W...
Authenticator Management | Protection of Authenticators
Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
Authenticator Management | No Embedded Unencrypted Static Authenticators
Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.
Authenticator Management | Multiple System Accounts
Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.
Authentication Feedback
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Cryptographic Module Authentication
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such...
Identification and Authentication (non-organizational Users)
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies
Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators
(a) Accept only external authenticators that are NIST-compliant; and (b) Document and maintain a list of accepted external authenticators.
Identification and Authentication (non-organizational Users) | Use of Defined Profiles
Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] incident...
Incident Response Training
a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming an incident response ro...
Incident Response Training | Simulated Events
Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
Incident Response Training | Automated Training Environments
Provide an incident response training environment using [Assignment: organization-defined automated mechanisms].
Incident Response Testing
Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].
Incident Response Testing | Coordination with Related Plans
Coordinate incident response testing with organizational elements responsible for related plans.
Incident Handling
a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;...
Incident Handling | Automated Incident Handling Processes
Support the incident handling process using [Assignment: organization-defined automated mechanisms].
Incident Handling | Integrated Incident Response Team
Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: organization-defined time period].
Incident Handling | Dynamic Reconfiguration
Include the following types of dynamic reconfiguration for [Assignment: organization-defined system components] as part of the incident response capability: [Assignment: organization-defined types of...
Incident Handling | Information Correlation
Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
Incident Handling | Insider Threats
Implement an incident handling capability for incidents involving insider threats.
Incident Monitoring
Track and document incidents.
Incident Monitoring | Automated Tracking, Data Collection, and Analysis
Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].
Incident Reporting
a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and b. Report incident information to [Ass...
Incident Reporting | Automated Reporting
Report incidents using [Assignment: organization-defined automated mechanisms].
Incident Reporting | Supply Chain Coordination
Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the i...
Incident Response Assistance
Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of i...
Incident Response Assistance | Automation Support for Availability of Information and Support
Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms].
Incident Response Plan
a. Develop an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability; 2. Describes the structure and organization of the incident...
Information Spillage Response
Respond to information spills by: a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills; b. Identifying the specific information...
Information Spillage Response | Training
Provide information spillage response training [Assignment: organization-defined frequency].
Information Spillage Response | Post-spill Operations
Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective...
Information Spillage Response | Exposure to Unauthorized Personnel
Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] maintena...
Controlled Maintenance
a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b....
Controlled Maintenance | Automated Maintenance Activities
(a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined automated mechanisms]; and (b) Produce up-to date, accurate, a...
Maintenance Tools
a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approved system maintenance tools [Assignment: organization-defined frequency].
Maintenance Tools | Inspect Tools
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
Maintenance Tools | Inspect Media
Check media containing diagnostic and test programs for malicious code before the media are used in the system.
Maintenance Tools | Prevent Unauthorized Removal
Prevent the removal of maintenance equipment containing organizational information by: (a) Verifying that there is no organizational information contained on the equipment; (b) Sanitizing or destroy...
Nonlocal Maintenance
a. Approve and monitor nonlocal maintenance and diagnostic activities; b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in th...
Nonlocal Maintenance | Comparable Security and Sanitization
(a) Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; o...
Maintenance Personnel
a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel; b. Verify that non-escorted personnel performing maintenance o...
Maintenance Personnel | Individuals Without Appropriate Access
(a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements: (1) Maintenance personnel w...
Timely Maintenance
Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] media pr...
Media Access
Restrict access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
Media Marking
a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and b. Exempt [Assignment: organization-defined types of...
Media Storage
a. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and b. Protect system...
Media Transport
a. Protect and control [Assignment: organization-defined types of system media] during transport outside of controlled areas using [Assignment: organization-defined controls]; b. Maintain accountabil...
Media Sanitization
a. Sanitize [Assignment: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniqu...
Media Sanitization | Review, Approve, Track, Document, and Verify
Review, approve, track, document, and verify media sanitization and disposal actions.
Media Sanitization | Equipment Testing
Test sanitization equipment and procedures [Assignment: organization-defined frequency] to ensure that the intended sanitization is being achieved.
Media Sanitization | Nondestructive Techniques
Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: [Assignment: organization-defined circumstanc...
Media Use
a. [Selection: Restrict; Prohibit] the use of [Assignment: organization-defined types of system media] on [Assignment: organization-defined systems or system components] using [Assignment: organizatio...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] personne...
Position Risk Designation
a. Assign a risk designation to all organizational positions; b. Establish screening criteria for individuals filling those positions; and c. Review and update position risk designations [Assignment...
Personnel Screening
a. Screen individuals prior to authorizing access to the system; and b. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreeni...
Personnel Screening | Information Requiring Special Protective Measures
Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: (a) Have valid access authorizations that are demonstrated by assigned offici...
Personnel Termination
Upon termination of individual employment: a. Disable system access within [Assignment: organization-defined time period]; b. Terminate or revoke any authenticators and credentials associated with t...
Personnel Termination | Automated Actions
Use [Assignment: organization-defined automated mechanisms] to [Selection (one or more): notify [Assignment: organization-defined personnel or roles] of individual termination actions; disable access...
Personnel Transfer
a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within...
Access Agreements
a. Develop and document access agreements for organizational systems; b. Review and update the access agreements [Assignment: organization-defined frequency]; and c. Verify that individuals requirin...
External Personnel Security
a. Establish personnel security requirements, including security roles and responsibilities for external providers; b. Require external providers to comply with personnel security policies and proced...
Personnel Sanctions
a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and b. Notify [Assignment: organization-defined perso...
Position Descriptions
Incorporate security and privacy roles and responsibilities into organizational position descriptions.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] physical...
Emergency Shutoff
a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations; b. Place emergency shutoff switches or devices in...
Emergency Power
Provide an uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary powe...
Emergency Power | Alternate Power Supply — Minimal Operational Capability
Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss...
Emergency Lighting
Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
Fire Protection
Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
Fire Protection | Detection Systems — Automatic Activation and Notification
Employ fire detection systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] in the event of a...
Fire Protection | Suppression Systems — Automatic Activation and Notification
(a) Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders]; and (b)...
Environmental Controls
a. Maintain [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control]] levels within the facility where the system resides at [Assi...
Environmental Controls | Monitoring with Alarms and Notifications
Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: organization-defined personnel or roles].
Water Damage Protection
Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
Water Damage Protection | Automation Support
Detect the presence of water near the system and alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms].
Delivery and Removal
a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility; and b. Maintain records of the system components.
Alternate Work Site
a. Determine and document the [Assignment: organization-defined alternate work sites] allowed for use by employees; b. Employ the following controls at alternate work sites: [Assignment: organization...
Location of System Components
Position system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized...
Physical Access Authorizations
a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b. Issue authorization credentials for facility access; c. Review the access...
Physical Access Control
a. Enforce physical access authorizations at [Assignment: organization-defined entry and exit points to the facility where the system resides] by: 1. Verifying individual access authorizations before...
Physical Access Control | System Access
Enforce physical access authorizations to the system in addition to the physical access controls for the facility at [Assignment: organization-defined physical spaces containing one or more components...
Access Control for Transmission
Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls].
Access Control for Output Devices
Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output.
Monitoring Physical Access
a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents; b. Review physical access logs [Assignment: organization-defined frequency] a...
Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment
Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.
Monitoring Physical Access | Monitoring Physical Access to Systems
Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces containing one or more components of the system...
Visitor Access Records
a. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period]; b. Review visitor access records [Assignment: organization-defined freq...
Visitor Access Records | Automated Records Maintenance and Review
Maintain and review visitor access records using [Assignment: organization-defined automated mechanisms].
Power Equipment and Cabling
Protect power equipment and power cabling for the system from damage and destruction.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] planning...
Baseline Selection
Select a control baseline for the system.
Baseline Tailoring
Tailor the selected control baseline by applying specified tailoring actions.
System Security and Privacy Plans
a. Develop security and privacy plans for the system that: 1. Are consistent with the organization’s enterprise architecture; 2. Explicitly define the constituent system components; 3. Describe the...
Rules of Behavior
a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b...
Rules of Behavior | Social Media and External Site/application Usage Restrictions
Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information on public websites; and...
Security and Privacy Architectures
a. Develop security and privacy architectures for the system that: 1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizatio...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] risk ass...
Security Categorization
a. Categorize the system and information it processes, stores, and transmits; b. Document the security categorization results, including supporting rationale, in the security plan for the system; and...
Risk Assessment
a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system; 2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, d...
Risk Assessment | Supply Chain Risk Assessment
(a) Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services]; and (b) Update the supply chain risk assessment [Assignment: organiz...
Vulnerability Monitoring and Scanning
a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new...
Vulnerability Monitoring and Scanning | Public Disclosure Program
Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.
Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
Update the system vulnerabilities to be scanned [Selection (one or more): [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported].
Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage
Define the breadth and depth of vulnerability scanning coverage.
Vulnerability Monitoring and Scanning | Discoverable Information
Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].
Vulnerability Monitoring and Scanning | Privileged Access
Implement privileged access authorization to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].
Vulnerability Monitoring and Scanning | Review Historic Audit Logs
Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time peri...
Risk Response
Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
Criticality Analysis
Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organizatio...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] assessme...
Control Assessments
a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Contro...
Control Assessments | Independent Assessors
Employ independent assessors or assessment teams to conduct control assessments.
Control Assessments | Specialized Assessments
Include as part of control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; auto...
Control Assessments | Leveraging Results from External Organizations
Leverage the results of control assessments performed by [Assignment: organization-defined external organization] on [Assignment: organization-defined system] when the assessment meets [Assignment: or...
Information Exchange
a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; me...
Information Exchange | Transfer Authorizations
Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Plan of Action and Milestones
a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the contr...
Authorization
a. Assign a senior official as the authorizing official for the system; b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems...
Continuous Monitoring
Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the f...
Continuous Monitoring | Independent Assessment
Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
Continuous Monitoring | Risk Monitoring
Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring.
Penetration Testing
Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined systems or system components].
Penetration Testing | Independent Penetration Testing Agent or Team
Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.
Penetration Testing | Red Team Exercises
Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined re...
Internal System Connections
a. Authorize internal connections of [Assignment: organization-defined system components or classes of components] to the system; b. Document, for each internal connection, the interface characterist...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] supply c...
Inspection of Systems or Components
Inspect the following systems or system components [Selection (one or more): at random; at [Assignment: organization-defined frequency], upon [Assignment: organization-defined indications of need for...
Component Authenticity
a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b. Report counterfeit system componen...
Component Authenticity | Anti-counterfeit Training
Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).
Component Authenticity | Configuration Control for Component Service and Repair
Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system...
Component Disposal
Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods].
Supply Chain Risk Management Plan
a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of t...
Supply Chain Risk Management Plan | Establish SCRM Team
Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: or...
Supply Chain Controls and Processes
a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component] in co...
Acquisition Strategies, Tools, and Methods
Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined acquisition strate...
Supplier Assessments and Reviews
Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].
Notification Agreements
Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compro...
Tamper Resistance and Detection
Implement a tamper protection program for the system, system component, or system service.
Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle
Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system a...
Network Disconnect
Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.
Cryptographic Key Establishment and Management
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for...
Cryptographic Key Establishment and Management | Availability
Maintain availability of information in the event of the loss of cryptographic keys by users.
Cryptographic Protection
a. Determine the [Assignment: organization-defined cryptographic uses]; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-d...
Collaborative Computing Devices and Applications
a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed];...
Public Key Infrastructure Certificates
a. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and b. Include only approved trust...
Mobile Code
a. Define acceptable and unacceptable mobile code and mobile code technologies; and b. Authorize, monitor, and control the use of mobile code within the system.
Separation of System and User Functionality
Separate user functionality, including user interface services, from system management functionality.
Secure Name/address Resolution Service (authoritative Source)
a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resoluti...
Secure Name/address Resolution Service (recursive or Caching Resolver)
Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
Architecture and Provisioning for Name/address Resolution Service
Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.
Session Authenticity
Protect the authenticity of communications sessions.
Fail in Known State
Fail to a [Assignment: organization-defined known system state] for the following failures on the indicated components while preserving [Assignment: organization-defined system state information] in f...
Protection of Information at Rest
Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].
Protection of Information at Rest | Cryptographic Protection
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignmen...
Security Function Isolation
Isolate security functions from nonsecurity functions.
Process Isolation
Maintain a separate execution domain for each executing system process.
Information in Shared System Resources
Prevent unauthorized and unintended information transfer via shared system resources.
System Time Synchronization
Synchronize system clocks within and between systems and system components.
System Time Synchronization | Synchronization with Authoritative Time Source
(a) Compare the internal system clocks [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source]; and (b) Synchronize the internal system clocks...
Denial-of-service Protection
a. [Selection: Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events]; and b. Employ the followin...
Boundary Protection
a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible syste...
Boundary Protection | Prevent Exfiltration
(a) Prevent the exfiltration of information; and (b) Conduct exfiltration tests [Assignment: organization-defined frequency].
Boundary Protection | Host-based Protection
Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].
Boundary Protection | Fail Secure
Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.
Boundary Protection | Dynamic Isolation and Segregation
Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.
Boundary Protection | Isolation of System Components
Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].
Boundary Protection | Access Points
Limit the number of external network connections to the system.
Boundary Protection | External Telecommunications Services
(a) Implement a managed interface for each external telecommunication service; (b) Establish a traffic flow policy for each managed interface; (c) Protect the confidentiality and integrity of the i...
Boundary Protection | Deny by Default — Allow by Exception
Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].
Boundary Protection | Split Tunneling for Remote Devices
Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].
Boundary Protection | Route Traffic to Authenticated Proxy Servers
Route [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.
Transmission Confidentiality and Integrity
Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.
Transmission Confidentiality and Integrity | Cryptographic Protection
Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system a...
Information Input Validation
Check the validity of the following information inputs: [Assignment: organization-defined information inputs to the system].
Error Handling
a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b. Reveal error messages only to [Assignment: organizat...
Information Management and Retention
Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines an...
Memory Protection
Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls].
Flaw Remediation
a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security...
Flaw Remediation | Automated Flaw Remediation Status
Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined...
Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions
(a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks].
Malicious Code Protection
a. Implement [Selection (one or more): signature based; non-signature based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatica...
System Monitoring
a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and...
System Monitoring | System-wide Intrusion Detection System
Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
System Monitoring | Visibility of Encrypted Communications
Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].
System Monitoring | Analyze Communications Traffic Anomalies
Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points within the system] to discover anomalies.
System Monitoring | Automated Organization-generated Alerts
Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with sec...
System Monitoring | Wireless Intrusion Detection
Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
System Monitoring | Correlate Monitoring Information
Correlate information from monitoring tools and mechanisms employed throughout the system.
System Monitoring | Analyze Traffic and Covert Exfiltration
Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interi...
System Monitoring | Risk for Individuals
Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.
System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
Employ automated tools and mechanisms to support near real-time analysis of events.
System Monitoring | Privileged Users
Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].
System Monitoring | Unauthorized Network Services
(a) Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes]; and (b) [Selection (one or more): Audit; Alert [Assig...
System Monitoring | Host-based Devices
Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].
System Monitoring | Inbound and Outbound Communications Traffic
(a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic; (b) Monitor inbound and outbound communications traffic [Assignment: orga...
System Monitoring | System-generated Alerts
Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise in...
Security Alerts, Advisories, and Directives
a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis; b. Generate internal security alerts, advisories, and...
Security Alerts, Advisories, and Directives | Automated Alerts and Advisories
Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].
Security and Privacy Function Verification
a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): [Assign...
Software, Firmware, and Information Integrity
a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and...
Software, Firmware, and Information Integrity | Integrity Checks
Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or s...
Software, Firmware, and Information Integrity | Code Authentication
Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].
Software, Firmware, and Information Integrity | Automated Notifications of Integrity Violations
Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
Software, Firmware, and Information Integrity | Automated Response to Integrity Violations
Automatically [Selection (one or more): shut the system down; restart the system; implement [Assignment: organization-defined controls]] when integrity violations are discovered.
Software, Firmware, and Information Integrity | Integration of Detection and Response
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].
Spam Protection
a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance...
Spam Protection | Automatic Updates
Automatically update spam protection mechanisms [Assignment: organization-defined frequency].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system a...
Developer Configuration Management
Require the developer of the system, system component, or system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; im...
Developer Testing and Evaluation
Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: a. Develop and implement a plan for ongoing security and...
Developer Testing and Evaluation | Static Code Analysis
Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses
Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the syste...
Development Process, Standards, and Tools
a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies...
Development Process, Standards, and Tools | Criticality Analysis
Require the developer of the system, system component, or system service to perform a criticality analysis: (a) At the following decision points in the system development life cycle: [Assignment: org...
Developer-provided Training
Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls,...
Developer Security and Privacy Architecture and Design
Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a. Is consistent with the organization’s securit...
Allocation of Resources
a. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b. Determine, document, and allocate the resources...
Developer Screening
Require that the developer of [Assignment: organization-defined system, system component, or system service]: a. Has appropriate access authorizations as determined by assigned [Assignment: organizat...
Unsupported System Components
a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for contin...
System Development Life Cycle
a. Acquire, develop, and manage the system using [Assignment: organization-defined system development life cycle] that incorporates information security and privacy considerations; b. Define and docu...
Acquisition Process
Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection (one or more): standardized contract language; [Assignment: organization-defined contract l...
Acquisition Process | Functional Properties of Controls
Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.
Acquisition Process | Use of Approved PIV Products
Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.
Acquisition Process | Design and Implementation Information for Controls
Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection (one or more): security-relevant ex...
Acquisition Process | System, Component, and Service Configurations
Require the developer of the system, system component, or system service to: (a) Deliver the system, component, or service with [Assignment: organization-defined security configurations] implemented;...
Acquisition Process | Functions, Ports, Protocols, and Services in Use
Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.
System Documentation
a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or...
Security and Privacy Engineering Principles
Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: or...
External System Services
a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls]; b. D...
External System Services | Risk Assessments and Organizational Approvals
(a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and (b) Verify that the acquisition or outsourcing of dedicated information...
External System Services | Identification of Functions, Ports, Protocols, and Services
Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: organization-defined ext...
External System Services | Processing, Storage, and Service Location
Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defi...