Showing 59 controls
Authorized users are identified.
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
Processes acting on behalf of authorized users are identified.
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
Devices (including other systems) authorized to connect to the system are identified.
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
System access is limited to authorized users.
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
System access is limited to processes acting on behalf of authorized users.
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
System access is limited to authorized devices (including other systems).
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
The types of transactions and functions that authorized users are permitted to execute are defined.
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
System access is limited to the defined types of transactions and functions for authorized users.
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
Connections to external systems are identified.
Verify and control/limit connections to and use of external systems.
Use of external systems is identified.
Verify and control/limit connections to and use of external systems.
Connections to external systems are verified.
Verify and control/limit connections to and use of external systems.
Use of external systems is verified.
Verify and control/limit connections to and use of external systems.
Connections to external systems are controlled/limited.
Verify and control/limit connections to and use of external systems.
Use of external systems is controlled/limited.
Verify and control/limit connections to and use of external systems.
Individuals authorized to post or process information on publicly accessible systems are identified.
Control CUI posted or processed on publicly accessible systems.
Procedures to ensure CUI is not posted or processed on publicly accessible systems are identified.
Control CUI posted or processed on publicly accessible systems.
A review process in in place prior to posting of any content to publicly accessible systems.
Control CUI posted or processed on publicly accessible systems.
Content on publicly accessible systems is reviewed to ensure that it does not include
FCI. Control CUI posted or processed on publicly accessible systems.
Mechanisms are in place to remove and address improper posting of FCI.
Control CUI posted or processed on publicly accessible systems.
System users are identified.
Identify system users, processes acting on behalf of users, and devices.
Processes acting on behalf of users are identified.
Identify system users, processes acting on behalf of users, and devices.
Devices accessing the system are identified.
Identify system users, processes acting on behalf of users, and devices.
The identity of each user is authenticated or verified as a prerequisite to system access.
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
The identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
The identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
System media containing CUI is sanitized or destroyed before disposal.
Sanitize or destroy system media containing CUI before disposal or release for reuse.
System media containing CUI is sanitized before it is released for reuse.
Sanitize or destroy system media containing CUI before disposal or release for reuse.
Visitors are escorted.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Visitor activity is monitored.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Audit logs of physical access are maintained.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Physical access devices are identified.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Physical access devices are controlled.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Physical access devices are managed.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Authorized individuals allowed physical access are identified.
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Physical access to organizational systems is limited to authorized individuals.
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Physical access to equipment is limited to authorized individuals.
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Physical access to operating environments is limited to authorized individuals.
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
The external system boundary is defined.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Key internal system boundaries are defined.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Communications are monitored at the external system boundary.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Communications are monitored at key internal boundaries.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Communications are controlled at the external system boundary.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Communications are controlled at key internal boundaries.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Communications are protected at the external system boundary.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Communications are protected at key internal boundaries.
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Publicly accessible system components are identified.
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Subnetworks for publicly accessible system components are physically or logically separated from internal networks.
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
The time within which to identify system flaws is specified.
dentify, report, and correct system flaws in a timely manner.
System flaws are identified within the specified time frame.
Identify, report, and correct system flaws in a timely manner.
The time within which to report system flaws is specified.
dentify, report, and correct system flaws in a timely manner.
System flaws are reported within the specified time frame.
dentify, report, and correct system flaws in a timely manner.
The time within which to correct system flaws is specified.
dentify, report, and correct system flaws in a timely manner.
System flaws are corrected within the specified time frame.
dentify, report, and correct system flaws in a timely manner.
Designated locations for malicious code protection are identified.
Provide protection from malicious code at designated locations within organizational systems.
Protection from malicious code at designated locations is provided.
Provide protection from malicious code at designated locations within organizational systems.
Determine if malicious code protection mechanisms are updated when new releases are available.
Update malicious code protection mechanisms when new releases are available.
The frequency for malicious code scans is defined.
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
Malicious code scans are performed with the defined frequency.
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
Real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.