Showing 1189 controls
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] access co...
Concurrent Session Control
Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number].
Device Lock
a. Prevent further access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a devic...
Device Lock | Pattern-hiding Displays
Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Session Termination
Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].
Session Termination | User-initiated Logouts
Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].
Session Termination | Termination Message
Display an explicit logout message to users indicating the termination of authenticated communications sessions.
Session Termination | Timeout Warning Message
Display an explicit message to users indicating that the session will end in [Assignment: organization-defined time until end of session].
Supervision and Review — Access Control
[Withdrawn: Incorporated into AC-2 and AU-6.]
Permitted Actions Without Identification or Authentication
a. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions;...
Permitted Actions Without Identification or Authentication | Necessary Uses
[Withdrawn: Incorporated into AC-14.]
Automated Marking
[Withdrawn: Incorporated into MP-3.]
Security and Privacy Attributes
a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for informat...
Security and Privacy Attributes | Dynamic Attribute Association
Dynamically associate security and privacy attributes with [Assignment: organization-defined subjects and objects] in accordance with the following security and privacy policies as information is crea...
Security and Privacy Attributes | Attribute Configuration by Authorized Individuals
Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.
Security and Privacy Attributes | Attribute Value Changes by Authorized Individuals
Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.
Security and Privacy Attributes | Maintenance of Attribute Associations by System
Maintain the association and integrity of [Assignment: organization-defined security and privacy attributes] to [Assignment: organization-defined subjects and objects].
Security and Privacy Attributes | Association of Attributes by Authorized Individuals
Provide the capability to associate [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] by authorized individuals (or proces...
Security and Privacy Attributes | Attribute Displays on Objects to Be Output
Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined special dissemination, handling,...
Security and Privacy Attributes | Maintenance of Attribute Association
Require personnel to associate and maintain the association of [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] in accord...
Security and Privacy Attributes | Consistent Attribute Interpretation
Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.
Security and Privacy Attributes | Association Techniques and Technologies
Implement [Assignment: organization-defined techniques and technologies] in associating security and privacy attributes to information.
Security and Privacy Attributes | Attribute Reassignment — Regrading Mechanisms
Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures].
Remote Access
a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to...
Remote Access | Monitoring and Control
Employ automated mechanisms to monitor and control remote access methods.
Remote Access | Authenticate Remote Commands
Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands].
Remote Access | Protection of Confidentiality and Integrity Using Encryption
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Remote Access | Managed Access Control Points
Route remote accesses through authorized and managed network access control points.
Remote Access | Privileged Commands and Access
(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assign...
Remote Access | Monitoring for Unauthorized Connections
[Withdrawn: Incorporated into SI-4.]
Remote Access | Protection of Mechanism Information
Protect information about remote access mechanisms from unauthorized use and disclosure.
Remote Access | Additional Protection for Security Function Access
[Withdrawn: Incorporated into AC-3(10).]
Remote Access | Disable Nonsecure Network Protocols
[Withdrawn: Incorporated into CM-7.]
Remote Access | Disconnect or Disable Access
Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].
Wireless Access
a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior to all...
Wireless Access | Authentication and Encryption
Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
Wireless Access | Monitoring Unauthorized Connections
[Withdrawn: Incorporated into SI-4.]
Wireless Access | Disable Wireless Networking
Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
Wireless Access | Restrict Configurations by Users
Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
Wireless Access | Antennas and Transmission Power Levels
Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
Access Control for Mobile Devices
a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas;...
Access Control for Mobile Devices | Use of Writable and Portable Storage Devices
[Withdrawn: Incorporated into MP-7.]
Access Control for Mobile Devices | Use of Personally Owned Portable Storage Devices
[Withdrawn: Incorporated into MP-7.]
Access Control for Mobile Devices | Use of Portable Storage Devices with No Identifiable Owner
[Withdrawn: Incorporated into MP-7.]
Access Control for Mobile Devices | Restrictions for Classified Information
(a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing offici...
Access Control for Mobile Devices | Full Device or Container-based Encryption
Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].
Account Management
a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: organization-defined prerequisites and c...
Account Management | Automated System Account Management
Support the management of system accounts using [Assignment: organization-defined automated mechanisms].
Account Management | Shared and Group Account Credential Change
[Withdrawn: Incorporated into AC-2k.]
Account Management | Usage Conditions
Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].
Account Management | Account Monitoring for Atypical Usage
(a) Monitor system accounts for [Assignment: organization-defined atypical usage]; and (b) Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].
Account Management | Disable Accounts for High-risk Individuals
Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].
Account Management | Automated Temporary and Emergency Account Management
Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].
Account Management | Disable Accounts
Disable accounts within [Assignment: organization-defined time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizatio...
Account Management | Automated Audit Actions
Automatically audit account creation, modification, enabling, disabling, and removal actions.
Account Management | Inactivity Logout
Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].
Account Management | Dynamic Privilege Management
Implement [Assignment: organization-defined dynamic privilege management capabilities].
Account Management | Privileged User Accounts
(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments...
Account Management | Dynamic Account Management
Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically.
Account Management | Restrictions on Use of Shared and Group Accounts
Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions for establishing shared and group accounts].
Use of External Systems
a. [Selection (one or more): Establish [Assignment: organization-defined terms and conditions]; Identify [Assignment: organization-defined controls asserted to be implemented on external systems]], co...
Use of External Systems | Limits on Authorized Use
Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementation of...
Use of External Systems | Portable Storage Devices — Restricted Use
Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].
Use of External Systems | Non-organizationally Owned Systems — Restricted Use
Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: organization-defined restrictions].
Use of External Systems | Network Accessible Storage Devices — Prohibited Use
Prohibit the use of [Assignment: organization-defined network accessible storage devices] in external systems.
Use of External Systems | Portable Storage Devices — Prohibited Use
Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
Information Sharing
a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: organization-defined informatio...
Information Sharing | Automated Decision Support
Employ [Assignment: organization-defined automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions o...
Information Sharing | Information Search and Retrieval
Implement information search and retrieval services that enforce [Assignment: organization-defined information sharing restrictions].
Publicly Accessible Content
a. Designate individuals authorized to make information publicly accessible; b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c. R...
Data Mining Protection
Employ [Assignment: organization-defined data mining prevention and detection techniques] for [Assignment: organization-defined data storage objects] to detect and protect against unauthorized data mi...
Access Control Decisions
[Selection: Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement.
Access Control Decisions | Transmit Access Authorization Information
Transmit [Assignment: organization-defined access authorization information] using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control...
Access Control Decisions | No User or Process Identity
Enforce access control decisions based on [Assignment: organization-defined security or privacy attributes] that do not include the identity of the user or process acting on behalf of the user.
Reference Monitor
Implement a reference monitor for [Assignment: organization-defined access control policies] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completene...
Access Enforcement
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Access Enforcement | Restricted Access to Privileged Functions
[Withdrawn: Incorporated into AC-6.]
Access Enforcement | Audited Override of Access Control Mechanisms
Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].
Access Enforcement | Restrict Access to Specific Information Types
Restrict access to data repositories containing [Assignment: organization-defined information types].
Access Enforcement | Assert and Enforce Application Access
(a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and...
Access Enforcement | Attribute-based Access Control
Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].
Access Enforcement | Individual Access
Provide [Assignment: organization-defined mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: organization-defined ele...
Access Enforcement | Discretionary and Mandatory Access Control
(a) Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and (b) Enforce [Assignment: organization-defined d...
Access Enforcement | Dual Authorization
Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].
Access Enforcement | Mandatory Access Control
Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across...
Access Enforcement | Discretionary Access Control
Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that...
Access Enforcement | Security-relevant Information
Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.
Access Enforcement | Protection of User and System Information
[Withdrawn: Incorporated into MP-4 and SC-28.]
Access Enforcement | Role-based Access Control
Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].
Access Enforcement | Revocation of Access Authorizations
Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revoc...
Access Enforcement | Controlled Release
Release information outside of the system only if: (a) The receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls]; and (b) [Assign...
Information Flow Enforcement
Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].
Information Flow Enforcement | Object Security and Privacy Attributes
Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organizat...
Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters
Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined security or privacy policy filters] under the following conditions: [Assignment: organizati...
Information Flow Enforcement | Configuration of Security or Privacy Policy Filters
Provide the capability for privileged administrators to configure [Assignment: organization-defined security or privacy policy filters] to support different security or privacy policies.
Information Flow Enforcement | Data Type Identifiers
When transferring information between different security domains, use [Assignment: organization-defined data type identifiers] to validate data essential for information flow decisions.
Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents
When transferring information between different security domains, decompose information into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mecha...
Information Flow Enforcement | Security or Privacy Policy Filter Constraints
When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data...
Information Flow Enforcement | Detection of Unsanctioned Information
When transferring information between different security domains, examine the information for the presence of [Assignment: organization-defined unsanctioned information] and prohibit the transfer of s...
Information Flow Enforcement | Information Transfers on Interconnected Systems
[Withdrawn: Incorporated into AC-4.]
Information Flow Enforcement | Domain Authentication
Uniquely identify and authenticate source and destination points by [Selection (one or more): organization; system; application; service; individual] for information transfer.
Information Flow Enforcement | Security Attribute Binding
[Withdrawn: Incorporated into AC-16.]
Information Flow Enforcement | Validation of Metadata
When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] on metadata.
Information Flow Enforcement | Processing Domains
Use protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
Information Flow Enforcement | Approved Solutions
Employ [Assignment: organization-defined solutions in approved configurations] to control the flow of [Assignment: organization-defined information] across security domains.
Information Flow Enforcement | Physical or Logical Separation of Information Flows
Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types o...
Information Flow Enforcement | Access Only
Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security doma...
Information Flow Enforcement | Modify Non-releasable Information
When transferring information between different security domains, modify non-releasable information by implementing [Assignment: organization-defined modification action].
Information Flow Enforcement | Internal Normalized Format
When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.
Information Flow Enforcement | Data Sanitization
When transferring information between different security domains, sanitize data to minimize [Selection (one or more): delivery of malicious content, command and control of malicious code, malicious co...
Information Flow Enforcement | Audit Filtering Actions
When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
Information Flow Enforcement | Redundant/independent Filtering Mechanisms
When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
Information Flow Enforcement | Linear Filter Pipelines
When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
Information Flow Enforcement | Filter Orchestration Engines
When transferring information between different security domains, employ content filter orchestration engines to ensure that: (a) Content filtering mechanisms successfully complete execution without e...
Information Flow Enforcement | Dynamic Information Flow Control
Enforce [Assignment: organization-defined information flow control policies].
Information Flow Enforcement | Filter Mechanisms Using Multiple Processes
When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
Information Flow Enforcement | Failed Content Transfer Prevention
When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
Information Flow Enforcement | Process Requirements for Information Transfer
When transferring information between different security domains, the process that transfers information between filter pipelines: (a) Does not filter message content; (b) Validates filtering metadata...
Information Flow Enforcement | Flow Control of Encrypted Information
Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the en...
Information Flow Enforcement | Embedded Data Types
Enforce [Assignment: organization-defined limitations] on embedding data types within other data types.
Information Flow Enforcement | Metadata
Enforce information flow control based on [Assignment: organization-defined metadata].
Information Flow Enforcement | One-way Flow Mechanisms
Enforce one-way information flows through hardware-based flow control mechanisms.
Information Flow Enforcement | Security and Privacy Policy Filters
(a) Enforce information flow control using [Assignment: organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined information...
Information Flow Enforcement | Human Reviews
Enforce the use of human reviews for [Assignment: organization-defined information flows] under the following conditions: [Assignment: organization-defined conditions].
Separation of Duties
a. Identify and document [Assignment: organization-defined duties of individuals requiring separation]; and b. Define system access authorizations to support separation of duties.
Least Privilege
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Least Privilege | Authorize Access to Security Functions
Authorize access for [Assignment: organization-defined individuals or roles] to: (a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]; and (b) [Assi...
Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
Prevent non-privileged users from executing privileged functions.
Least Privilege | Non-privileged Access for Nonsecurity Functions
Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when access...
Least Privilege | Network Access to Privileged Commands
Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access i...
Least Privilege | Separate Processing Domains
Provide separate processing domains to enable finer-grained allocation of user privileges.
Least Privilege | Privileged Accounts
Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].
Least Privilege | Privileged Access by Non-organizational Users
Prohibit privileged access to the system by non-organizational users.
Least Privilege | Review of User Privileges
(a) Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and (b) Reassi...
Least Privilege | Privilege Levels for Code Execution
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: organization-defined software].
Least Privilege | Log Use of Privileged Functions
Log the execution of privileged functions.
Unsuccessful Logon Attempts
a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; and b. Automatically [Selection (o...
Unsuccessful Logon Attempts | Automatic Account Lock
[Withdrawn: Incorporated into AC-7.]
Unsuccessful Logon Attempts | Purge or Wipe Mobile Device
Purge or wipe information from [Assignment: organization-defined mobile devices] based on [Assignment: organization-defined purging or wiping requirements and techniques] after [Assignment: organizati...
Unsuccessful Logon Attempts | Biometric Attempt Limiting
Limit the number of unsuccessful biometric logon attempts to [Assignment: organization-defined number].
Unsuccessful Logon Attempts | Use of Alternate Authentication Factor
(a) Allow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid l...
System Use Notification
a. Display [Assignment: organization-defined system use notification message or banner] to users before granting access to the system that provides privacy and security notices consistent with applica...
Previous Logon Notification
Notify the user, upon successful logon to the system, of the date and time of the last logon.
Previous Logon Notification | Unsuccessful Logons
Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
Previous Logon Notification | Successful and Unsuccessful Logons
Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period].
Previous Logon Notification | Notification of Account Changes
Notify the user, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters of the user’s account] during [Assignment: organization-defined t...
Previous Logon Notification | Additional Logon Information
Notify the user, upon successful logon, of the following additional information: [Assignment: organization-defined additional information].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] assessmen...
Control Assessments
a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Controls...
Control Assessments | Independent Assessors
Employ independent assessors or assessment teams to conduct control assessments.
Control Assessments | Specialized Assessments
Include as part of control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; auto...
Control Assessments | Leveraging Results from External Organizations
Leverage the results of control assessments performed by [Assignment: organization-defined external organization] on [Assignment: organization-defined system] when the assessment meets [Assignment: or...
Information Exchange
a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; me...
Information Exchange | Unclassified National Security System Connections
[Withdrawn: Moved to SC-7(25).]
Information Exchange | Classified National Security System Connections
[Withdrawn: Moved to SC-7(26).]
Information Exchange | Unclassified Non-national Security System Connections
[Withdrawn: Moved to SC-7(27).]
Information Exchange | Connections to Public Networks
[Withdrawn: Moved to SC-7(28).]
Information Exchange | Restrictions on External System Connections
[Withdrawn: Moved to SC-7(5).]
Information Exchange | Transfer Authorizations
Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Information Exchange | Transitive Information Exchanges
(a) Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a; and (b) Take measures to ensure that transitive (downstream) information exchange...
Security Certification
[Withdrawn: Incorporated into CA-2.]
Plan of Action and Milestones
a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the contr...
Plan of Action and Milestones | Automation Support for Accuracy and Currency
Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: organization-defined automated mechanisms].
Authorization
a. Assign a senior official as the authorizing official for the system; b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;...
Authorization | Joint Authorization — Intra-organization
Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.
Authorization | Joint Authorization — Inter-organization
Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the...
Continuous Monitoring
Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the fo...
Continuous Monitoring | Independent Assessment
Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
Continuous Monitoring | Types of Assessments
[Withdrawn: Incorporated into CA-2.]
Continuous Monitoring | Trend Analyses
Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modif...
Continuous Monitoring | Risk Monitoring
Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring.
Continuous Monitoring | Consistency Analysis
Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignment: organization-defined actions].
Continuous Monitoring | Automation Support for Monitoring
Ensure the accuracy, currency, and availability of monitoring results for the system using [Assignment: organization-defined automated mechanisms].
Penetration Testing
Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined systems or system components].
Penetration Testing | Independent Penetration Testing Agent or Team
Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.
Penetration Testing | Red Team Exercises
Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined re...
Penetration Testing | Facility Penetration Testing
Employ a penetration testing process that includes [Assignment: organization-defined frequency] [Selection: announced; unannounced] attempts to bypass or circumvent controls associated with physical a...
Internal System Connections
a. Authorize internal connections of [Assignment: organization-defined system components or classes of components] to the system; b. Document, for each internal connection, the interface characteristi...
Internal System Connections | Compliance Checks
Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] audit and...
Non-repudiation
Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation].
Non-repudiation | Association of Identities
(a) Bind the identity of the information producer with the information to [Assignment: organization-defined strength of binding]; and (b) Provide the means for authorized individuals to determine the...
Non-repudiation | Validate Binding of Information Producer Identity
(a) Validate the binding of the information producer identity to the information at [Assignment: organization-defined frequency]; and (b) Perform [Assignment: organization-defined actions] in the even...
Non-repudiation | Chain of Custody
Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.
Non-repudiation | Validate Binding of Information Reviewer Identity
(a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: organization-defined security domai...
Non-repudiation | Digital Signatures
[Withdrawn: Incorporated into SI-7.]
Audit Record Retention
Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulator...
Audit Record Retention | Long-term Retrieval Capability
Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.
Audit Record Generation
a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components]; b. Allow [Assignment: o...
Audit Record Generation | System-wide and Time-correlated Audit Trail
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined...
Audit Record Generation | Standardized Formats
Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
Audit Record Generation | Changes by Authorized Individuals
Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on...
Audit Record Generation | Query Parameter Audits of Personally Identifiable Information
Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
Monitoring for Information Disclosure
a. Monitor [Assignment: organization-defined open-source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational in...
Monitoring for Information Disclosure | Use of Automated Tools
Monitor open-source information and information sites using [Assignment: organization-defined automated mechanisms].
Monitoring for Information Disclosure | Review of Monitored Sites
Review the list of open-source information sites being monitored [Assignment: organization-defined frequency].
Monitoring for Information Disclosure | Unauthorized Replication of Information
Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.
Session Audit
a. Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: org...
Session Audit | System Start-up
Initiate session audits automatically at system start-up.
Session Audit | Capture and Record Content
[Withdrawn: Incorporated into AU-14.]
Session Audit | Remote Viewing and Listening
Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
Alternate Audit Logging Capability
[Withdrawn: Moved to AU-5(5).]
Cross-organizational Audit Logging
Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organi...
Cross-organizational Audit Logging | Identity Preservation
Preserve the identity of individuals in cross-organizational audit trails.
Cross-organizational Audit Logging | Sharing of Audit Information
Provide cross-organizational audit information to [Assignment: organization-defined organizations] based on [Assignment: organization-defined cross-organizational sharing agreements].
Cross-organizational Audit Logging | Disassociability
Implement [Assignment: organization-defined measures] to disassociate individuals from audit information transmitted across organizational boundaries.
Event Logging
a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging]; b. Coordin...
Event Logging | Compilation of Audit Records from Multiple Sources
[Withdrawn: Incorporated into AU-12.]
Event Logging | Selection of Audit Events by Component
[Withdrawn: Incorporated into AU-12.]
Event Logging | Reviews and Updates
[Withdrawn: Incorporated into AU-2.]
Event Logging | Privileged Functions
[Withdrawn: Incorporated into AC-6(9).]
Content of Audit Records
Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcom...
Content of Audit Records | Additional Audit Information
Generate audit records containing the following additional information: [Assignment: organization-defined additional information].
Content of Audit Records | Centralized Management of Planned Audit Record Content
[Withdrawn: Incorporated into PL-9.]
Content of Audit Records | Limit Personally Identifiable Information Elements
Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].
Audit Log Storage Capacity
Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].
Audit Log Storage Capacity | Transfer to Alternate Storage
Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Response to Audit Logging Process Failures
a. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure; and b. Take the following additio...
Response to Audit Logging Process Failures | Storage Capacity Warning
Provide a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assign...
Response to Audit Logging Process Failures | Real-time Alerts
Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Ass...
Response to Audit Logging Process Failures | Configurable Traffic Volume Thresholds
Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection: reject; delay] network traffic above those thresholds.
Response to Audit Logging Process Failures | Shutdown on Failure
Invoke a [Selection: full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: organization-define...
Response to Audit Logging Process Failures | Alternate Audit Logging Capability
Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: organization-defined alternate audit logging functionality].
Audit Record Review, Analysis, and Reporting
a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact...
Audit Record Review, Analysis, and Reporting | Automated Process Integration
Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].
Audit Record Review, Analysis, and Reporting | Audit Level Adjustment
[Withdrawn: Incorporated into AU-6.]
Audit Record Review, Analysis, and Reporting | Automated Security Alerts
[Withdrawn: Incorporated into SI-4.]
Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
Audit Record Review, Analysis, and Reporting | Central Review and Analysis
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records
Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined da...
Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity...
Audit Record Review, Analysis, and Reporting | Permitted Actions
Specify the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information.
Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged Commands
Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.
Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources
Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
Audit Record Reduction and Report Generation
Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations...
Audit Record Reduction and Report Generation | Automatic Processing
Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].
Audit Record Reduction and Report Generation | Automatic Sort and Search
[Withdrawn: Incorporated into AU-7(1).]
Time Stamps
a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and th...
Time Stamps | Synchronization with Authoritative Time Source
[Withdrawn: Moved to SC-45(1).]
Time Stamps | Secondary Authoritative Time Source
[Withdrawn: Moved to SC-45(2).]
Protection of Audit Information
a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthor...
Protection of Audit Information | Hardware Write-once Media
Write audit trails to hardware-enforced, write-once media.
Protection of Audit Information | Store on Separate Physical Systems or Components
Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
Protection of Audit Information | Cryptographic Protection
Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
Protection of Audit Information | Access by Subset of Privileged Users
Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].
Protection of Audit Information | Dual Authorization
Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].
Protection of Audit Information | Read-only Access
Authorize read-only access to audit information to [Assignment: organization-defined subset of privileged users or roles].
Protection of Audit Information | Store on Component with Different Operating System
Store audit information on a component running a different operating system than the system or component being audited.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] awareness...
Literacy Training and Awareness
a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-d...
Literacy Training and Awareness | Practical Exercises
Provide practical exercises in literacy training that simulate events and incidents.
Literacy Training and Awareness | Insider Threat
Provide literacy training on recognizing and reporting potential indicators of insider threat.
Literacy Training and Awareness | Social Engineering and Mining
Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior
Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: organization-defined indicators of malicious code].
Literacy Training and Awareness | Advanced Persistent Threat
Provide literacy training on the advanced persistent threat.
Literacy Training and Awareness | Cyber Threat Environment
(a) Provide literacy training on the cyber threat environment; and (b) Reflect current cyber threat information in system operations.
Role-based Training
a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: 1. Before authorizing acc...
Role-based Training | Environmental Controls
Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of environmental controls.
Role-based Training | Physical Security Controls
Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of physical security controls.
Role-based Training | Practical Exercises
Provide practical exercises in security and privacy training that reinforce training objectives.
Role-based Training | Suspicious Communications and Anomalous System Behavior
[Withdrawn: Moved to AT-2(4)].
Role-based Training | Processing Personally Identifiable Information
Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of personally identifiable informat...
Training Records
a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b. Retain ind...
Contacts with Security Groups and Associations
[Withdrawn: Incorporated into PM-15.]
Training Feedback
Provide feedback on organizational training results to the following personnel [Assignment: organization-defined frequency]: [Assignment: organization-defined personnel].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] configura...
Software Usage Restrictions
a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to cont...
Software Usage Restrictions | Open-source Software
Establish the following restrictions on the use of open-source software: [Assignment: organization-defined restrictions].
User-installed Software
a. Establish [Assignment: organization-defined policies] governing the installation of software by users; b. Enforce software installation policies through the following methods: [Assignment: organiza...
User-installed Software | Alerts for Unauthorized Installations
[Withdrawn: Incorporated into CM-8(3).]
User-installed Software | Software Installation with Privileged Status
Allow user installation of software only with explicit privileged status.
User-installed Software | Automated Enforcement and Monitoring
Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms].
Information Location
a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; b. Identify and document th...
Information Location | Automated Tools to Support Information Location
Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect or...
Data Action Mapping
Develop and document a map of system data actions.
Signed Components
Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized...
Baseline Configuration
a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: organ...
Baseline Configuration | Reviews and Updates
[Withdrawn: Incorporated into CM-2.]
Baseline Configuration | Automation Support for Accuracy and Currency
Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].
Baseline Configuration | Retention of Previous Configurations
Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.
Baseline Configuration | Unauthorized Software
[Withdrawn: Incorporated into CM-7(4).]
Baseline Configuration | Authorized Software
[Withdrawn: Incorporated into CM-7(5).]
Baseline Configuration | Development and Test Environments
Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.
Baseline Configuration | Configure Systems and Components for High-risk Areas
(a) Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be...
Configuration Change Control
a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes...
Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes
Use [Assignment: organization-defined automated mechanisms] to: (a) Document proposed changes to the system; (b) Notify [Assignment: organization-defined approval authorities] of proposed changes to t...
Configuration Change Control | Testing, Validation, and Documentation of Changes
Test, validate, and document changes to the system before finalizing the implementation of the changes.
Configuration Change Control | Automated Change Implementation
Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].
Configuration Change Control | Security and Privacy Representatives
Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element].
Configuration Change Control | Automated Security Response
Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: organization-defined security responses].
Configuration Change Control | Cryptography Management
Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls].
Configuration Change Control | Review System Changes
Review changes to the system [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.
Configuration Change Control | Prevent or Restrict Configuration Changes
Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: organization-defined circumstances].
Impact Analyses
Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
Impact Analyses | Separate Test Environments
Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or...
Impact Analyses | Verification of Controls
After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements...
Access Restrictions for Change
Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
Access Restrictions for Change | Automated Access Enforcement and Audit Records
(a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions.
Access Restrictions for Change | Review System Changes
[Withdrawn: Incorporated into CM-3(7).]
Access Restrictions for Change | Signed Components
[Withdrawn: Moved to CM-14.]
Access Restrictions for Change | Dual Authorization
Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].
Access Restrictions for Change | Privilege Limitation for Production and Operation
(a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment: organization-defin...
Access Restrictions for Change | Limit Library Privileges
Limit privileges to change software resident within software libraries.
Access Restrictions for Change | Automatic Implementation of Security Safeguards
[Withdrawn: Incorporated into SI-7.]
Configuration Settings
a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organizati...
Configuration Settings | Automated Management, Application, and Verification
Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms].
Configuration Settings | Respond to Unauthorized Changes
Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions].
Configuration Settings | Unauthorized Change Detection
[Withdrawn: Incorporated into SI-7.]
Configuration Settings | Conformance Demonstration
[Withdrawn: Incorporated into CM-4.]
Least Functionality
a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, a...
Least Functionality | Periodic Review
(a) Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [Assignment:...
Least Functionality | Prevent Program Execution
Prevent program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and rest...
Least Functionality | Registration Compliance
Ensure compliance with [Assignment: organization-defined registration requirements for functions, ports, protocols, and services].
Least Functionality | Unauthorized Software — Deny-by-exception
(a) Identify [Assignment: organization-defined software programs not authorized to execute on the system]; (b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized s...
Least Functionality | Authorized Software — Allow-by-exception
(a) Identify [Assignment: organization-defined software programs authorized to execute on the system]; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software p...
Least Functionality | Confined Environments with Limited Privileges
Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: organization-defined user-installed software].
Least Functionality | Code Execution in Protected Environments
Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] w...
Least Functionality | Binary or Machine Executable Code
(a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and (b) Allow exceptions only for compelling mission or oper...
Least Functionality | Prohibiting The Use of Unauthorized Hardware
(a) Identify [Assignment: organization-defined hardware components authorized for system use]; (b) Prohibit the use or connection of unauthorized hardware components; (c) Review and update the list o...
System Component Inventory
a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components...
System Component Inventory | Updates During Installation and Removal
Update the inventory of system components as part of component installations, removals, and system updates.
System Component Inventory | Automated Maintenance
Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].
System Component Inventory | Automated Unauthorized Component Detection
(a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined fr...
System Component Inventory | Accountability Information
Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible and accountable for administering those compo...
System Component Inventory | No Duplicate Accounting of Components
[Withdrawn: Incorporated into CM-8.]
System Component Inventory | Assessed Configurations and Approved Deviations
Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.
System Component Inventory | Centralized Repository
Provide a centralized repository for the inventory of system components.
System Component Inventory | Automated Location Tracking
Support the tracking of system components by geographic location using [Assignment: organization-defined automated mechanisms].
System Component Inventory | Assignment of Components to Systems
(a) Assign system components to a system; and (b) Receive an acknowledgement from [Assignment: organization-defined personnel or roles] of this assignment.
Configuration Management Plan
Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a proc...
Configuration Management Plan | Assignment of Responsibility
Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] contingen...
System Recovery and Reconstitution
Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a dis...
System Recovery and Reconstitution | Contingency Plan Testing
[Withdrawn: Incorporated into CP-4.]
System Recovery and Reconstitution | Transaction Recovery
Implement transaction recovery for systems that are transaction-based.
System Recovery and Reconstitution | Compensating Security Controls
[Withdrawn: Addressed through tailoring.]
System Recovery and Reconstitution | Restore Within Time Period
Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a...
System Recovery and Reconstitution | Failover Capability
[Withdrawn: Incorporated into SI-13.]
System Recovery and Reconstitution | Component Protection
Protect system components used for recovery and reconstitution.
Alternate Communications Protocols
Provide the capability to employ [Assignment: organization-defined alternative communications protocols] in support of maintaining continuity of operations.
Safe Mode
When [Assignment: organization-defined conditions] are detected, enter a safe mode of operation with [Assignment: organization-defined restrictions of safe mode of operation].
Alternative Security Mechanisms
Employ [Assignment: organization-defined alternative or supplemental security mechanisms] for satisfying [Assignment: organization-defined security functions] when the primary means of implementing th...
Contingency Plan
a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration prioriti...
Contingency Plan | Coordinate with Related Plans
Coordinate contingency plan development with organizational elements responsible for related plans.
Contingency Plan | Capacity Planning
Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
Contingency Plan | Resume Mission and Business Functions
Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: organization-defined time period] of contingency plan activation.
Contingency Plan | Resume All Mission and Business Functions
[Withdrawn: Incorporated into CP-2(3).]
Contingency Plan | Continue Mission and Business Functions
Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at p...
Contingency Plan | Alternate Processing and Storage Sites
Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that cont...
Contingency Plan | Coordinate with External Service Providers
Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
Contingency Plan | Identify Critical Assets
Identify critical system assets supporting [Selection: all; essential] mission and business functions.
Contingency Training
a. Provide contingency training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming a contingency role or respons...
Contingency Training | Simulated Events
Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.
Contingency Training | Mechanisms Used in Training Environments
Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.
Contingency Plan Testing
a. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [A...
Contingency Plan Testing | Coordinate with Related Plans
Coordinate contingency plan testing with organizational elements responsible for related plans.
Contingency Plan Testing | Alternate Processing Site
Test the contingency plan at the alternate processing site: (a) To familiarize contingency personnel with the facility and available resources; and (b) To evaluate the capabilities of the alternate pr...
Contingency Plan Testing | Automated Testing
Test the contingency plan using [Assignment: organization-defined automated mechanisms].
Contingency Plan Testing | Full Recovery and Reconstitution
Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.
Contingency Plan Testing | Self-challenge
Employ [Assignment: organization-defined mechanisms] to [Assignment: organization-defined system or system component] to disrupt and adversely affect the system or system component.
Contingency Plan Update
[Withdrawn: Incorporated into CP-2.]
Alternate Storage Site
a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls...
Alternate Storage Site | Separation from Primary Site
Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.
Alternate Storage Site | Recovery Time and Recovery Point Objectives
Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
Alternate Storage Site | Accessibility
Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.
Alternate Processing Site
a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and busine...
Alternate Processing Site | Separation from Primary Site
Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.
Alternate Processing Site | Accessibility
Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
Alternate Processing Site | Priority of Service
Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
Alternate Processing Site | Preparation for Use
Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions.
Alternate Processing Site | Equivalent Information Security Safeguards
Withdrawn: Incorporated into CP-7.]
Alternate Processing Site | Inability to Return to Primary Site
Plan and prepare for circumstances that preclude returning to the primary processing site.
Telecommunications Services
Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business func...
Telecommunications Services | Priority of Service Provisions
(a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); a...
Telecommunications Services | Single Points of Failure
Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
Telecommunications Services | Separation of Primary and Alternate Providers
Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
Telecommunications Services | Provider Contingency Plan
(a) Require primary and alternate telecommunications service providers to have contingency plans; (b) Review provider contingency plans to ensure that the plans meet organizational contingency require...
Telecommunications Services | Alternate Telecommunication Service Testing
Test alternate telecommunication services [Assignment: organization-defined frequency].
System Backup
a. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency consistent with recovery time and recovery po...
System Backup | Testing for Reliability and Integrity
Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.
System Backup | Test Restoration Using Sampling
Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.
System Backup | Separate Storage for Critical Information
Store backup copies of [Assignment: organization-defined critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated wit...
System Backup | Protection from Unauthorized Modification
[Withdrawn: Incorporated into CP-9.]
System Backup | Transfer to Alternate Storage Site
Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives].
System Backup | Redundant Secondary System
Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.
System Backup | Dual Authorization for Deletion or Destruction
Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined backup information].
System Backup | Cryptographic Protection
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] identific...
Adaptive Authentication
Require individuals accessing the system to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstance...
Re-authentication
Require users to re-authenticate when [Assignment: organization-defined circumstances or situations requiring re-authentication].
Identity Proofing
a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve...
Identity Proofing | Supervisor Authorization
Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Identity Proofing | Identity Evidence
Require evidence of individual identification be presented to the registration authority.
Identity Proofing | Identity Evidence Validation and Verification
Require that the presented identity evidence be validated and verified through [Assignment: organizational defined methods of validation and verification].
Identity Proofing | In-person Validation and Verification
Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
Identity Proofing | Address Confirmation
Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
Identity Proofing | Accept Externally-proofed Identities
Accept externally-proofed identities at [Assignment: organization-defined identity assurance level].
Identification and Authentication (organizational Users)
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts
Implement multi-factor authentication for access to privileged accounts.
Identification and Authentication (organizational Users) | Single Sign-on
Provide a single sign-on capability for [Assignment: organization-defined system accounts and services].
Identification and Authentication (organizational Users) | Remote Access — Separate Device
[Withdrawn: Incorporated into IA-2(6).]
Identification and Authentication (organizational Users) | Acceptance of PIV Credentials
Accept and electronically verify Personal Identity Verification-compliant credentials.
Identification and Authentication (organizational Users) | Out-of-band Authentication
Implement the following out-of-band authentication mechanisms under [Assignment: organization-defined conditions]: [Assignment: organization-defined out-of-band authentication].
Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts
Implement multi-factor authentication for access to non-privileged accounts.
Identification and Authentication (organizational Users) | Local Access to Privileged Accounts
[Withdrawn: Incorporated into IA-2(1).]
Identification and Authentication (organizational Users) | Local Access to Non-privileged Accounts
[Withdrawn: Incorporated into IA-2(2).]
Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication
When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
Identification and Authentication (organizational Users) | Access to Accounts —separate Device
Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the...
Identification and Authentication (organizational Users) | Network Access to Non-privileged Accounts — Separate Device
[Withdrawn: Incorporated into IA-2(6).]
Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant
Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].
Identification and Authentication (organizational Users) | Network Access to Non-privileged Accounts — Replay Resistant
[Withdrawn: Incorporated into IA-2(8).]
Device Identification and Authentication
Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.
Device Identification and Authentication | Cryptographic Bidirectional Authentication
Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that...
Device Identification and Authentication | Cryptographic Bidirectional Network Authentication
Withdrawn: Incorporated into IA-3(1).]
Device Identification and Authentication | Dynamic Address Allocation
(a) Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with [Assignment: organization-defined...
Device Identification and Authentication | Device Attestation
Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].
Identifier Management
Manage system identifiers by: a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier; b. Selecting an...
Identifier Management | Prohibit Account Identifiers as Public Identifiers
Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.
Identifier Management | Supervisor Authorization
[Withdrawn: Incorporated into IA-12(1).]
Identifier Management | Multiple Forms of Certification
[Withdrawn: Incorporated into IA-12(2).]
Identifier Management | Identify User Status
Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status].
Identifier Management | Dynamic Management
Manage individual identifiers dynamically in accordance with [Assignment: organization-defined dynamic identifier policy].
Identifier Management | Cross-organization Management
Coordinate with the following external organizations for cross-organization management of identifiers: [Assignment: organization-defined external organizations].
Identifier Management | In-person Registration
[Withdrawn: Incorporated into IA-12(4).]
Identifier Management | Pairwise Pseudonymous Identifiers
Generate pairwise pseudonymous identifiers.
Identifier Management | Attribute Maintenance and Protection
Maintain the attributes for each uniquely identified individual, device, or service in [Assignment: organization-defined protected central storage].
Authenticator Management
Manage system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b. Establ...
Authenticator Management | Password-based Authentication
For password-based authentication: (a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational pas...
Authenticator Management | Dynamic Credential Binding
Bind identities and authenticators dynamically using the following rules: [Assignment: organization-defined binding rules].
Authenticator Management | Hardware Token-based Authentication
[Withdrawn: Incorporated into IA-2(1) and IA-2(2).]
Authenticator Management | Biometric Authentication Performance
For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements].
Authenticator Management | Expiration of Cached Authenticators
Prohibit the use of cached authenticators after [Assignment: organization-defined time period].
Authenticator Management | Managing Content of PKI Trust Stores
For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and...
Authenticator Management | GSA-approved Products and Services
Use only General Services Administration-approved products and services for identity, credential, and access management.
Authenticator Management | In-person or Trusted External Party Authenticator Issuance
Require that the issuance of [Assignment: organization-defined types of and/or specific authenticators] be conducted [Selection: in person; by a trusted external party] before [Assignment: organizatio...
Authenticator Management | Presentation Attack Detection for Biometric Authenticators
Employ presentation attack detection mechanisms for biometric-based authentication.
Authenticator Management | Password Managers
(a) Employ [Assignment: organization-defined password managers] to generate and manage passwords; and (b) Protect the passwords using [Assignment: organization-defined controls].
Authenticator Management | Public Key-based Authentication
(a) For public key-based authentication: (1) Enforce authorized access to the corresponding private key; and (2) Map the authenticated identity to the account of the individual or group; and (b) When...
Authenticator Management | In-person or Trusted External Party Registration
[Withdrawn: Incorporated into IA-12(4).]
Authenticator Management | Automated Support for Password Strength Determination
[Withdrawn: Incorporated into IA-5(1).]
Authenticator Management | Change Authenticators Prior to Delivery
Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.
Authenticator Management | Protection of Authenticators
Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
Authenticator Management | No Embedded Unencrypted Static Authenticators
Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.
Authenticator Management | Multiple System Accounts
Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.
Authenticator Management | Federated Credential Management
Use the following external organizations to federate credentials: [Assignment: organization-defined external organizations].
Authentication Feedback
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Cryptographic Module Authentication
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such...
Identification and Authentication (non-organizational Users)
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies
Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators
(a) Accept only external authenticators that are NIST-compliant; and (b) Document and maintain a list of accepted external authenticators.
Identification and Authentication (non-organizational Users) | Use of FICAM-approved Products
[Withdrawn: Incorporated into IA-8(2).]
Identification and Authentication (non-organizational Users) | Use of Defined Profiles
Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles].
Identification and Authentication (non-organizational Users) | Acceptance of PVI-I Credentials
Accept and verify federated or PKI credentials that meet [Assignment: organization-defined policy].
Identification and Authentication (non-organizational Users) | Disassociability
Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: organization-d...
Service Identification and Authentication
Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications.
Service Identification and Authentication | Information Exchange
[Withdrawn: Incorporated into IA-9.]
Service Identification and Authentication | Transmission of Decisions
[Withdrawn: Incorporated into IA-9.]
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] incident...
Integrated Information Security Analysis Team
[Withdrawn: Moved to IR-4(11).]
Incident Response Training
a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming an incident response rol...
Incident Response Training | Simulated Events
Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
Incident Response Training | Automated Training Environments
Provide an incident response training environment using [Assignment: organization-defined automated mechanisms].
Incident Response Training | Breach
Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.
Incident Response Testing
Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].
Incident Response Testing | Automated Testing
Test the incident response capability using [Assignment: organization-defined automated mechanisms].
Incident Response Testing | Coordination with Related Plans
Coordinate incident response testing with organizational elements responsible for related plans.
Incident Response Testing | Continuous Improvement
Use qualitative and quantitative data from testing to: (a) Determine the effectiveness of incident response processes; (b) Continuously improve incident response processes; and (c) Provide incident re...
Incident Handling
a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;...
Incident Handling | Automated Incident Handling Processes
Support the incident handling process using [Assignment: organization-defined automated mechanisms].
Incident Handling | Supply Chain Coordination
Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.
Incident Handling | Integrated Incident Response Team
Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: organization-defined time period].
Incident Handling | Malicious Code and Forensic Analysis
Analyze malicious code and/or other residual artifacts remaining in the system after the incident.
Incident Handling | Behavior Analysis
Analyze anomalous or suspected adversarial behavior in or related to [Assignment: organization-defined environments or resources].
Incident Handling | Security Operations Center
Establish and maintain a security operations center.
Incident Handling | Public Relations and Reputation Repair
(a) Manage public relations associated with an incident; and (b) Employ measures to repair the reputation of the organization.
Incident Handling | Dynamic Reconfiguration
Include the following types of dynamic reconfiguration for [Assignment: organization-defined system components] as part of the incident response capability: [Assignment: organization-defined types of...
Incident Handling | Continuity of Operations
Identify [Assignment: organization-defined classes of incidents] and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions:...
Incident Handling | Information Correlation
Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
Incident Handling | Automatic Disabling of System
Implement a configurable capability to automatically disable the system if [Assignment: organization-defined security violations] are detected.
Incident Handling | Insider Threats
Implement an incident handling capability for incidents involving insider threats.
Incident Handling | Insider Threats — Intra-organization Coordination
Coordinate an incident handling capability for insider threats that includes the following organizational entities [Assignment: organization-defined entities].
Incident Handling | Correlation with External Organizations
Coordinate with [Assignment: organization-defined external organizations] to correlate and share [Assignment: organization-defined incident information] to achieve a cross-organization perspective on...
Incident Handling | Dynamic Response Capability
Employ [Assignment: organization-defined dynamic response capabilities] to respond to incidents.
Incident Monitoring
Track and document incidents.
Incident Monitoring | Automated Tracking, Data Collection, and Analysis
Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].
Incident Reporting
a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and b. Report incident information to [Assi...
Incident Reporting | Automated Reporting
Report incidents using [Assignment: organization-defined automated mechanisms].
Incident Reporting | Vulnerabilities Related to Incidents
Report system vulnerabilities associated with reported incidents to [Assignment: organization-defined personnel or roles].
Incident Reporting | Supply Chain Coordination
Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the i...
Incident Response Assistance
Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of i...
Incident Response Assistance | Automation Support for Availability of Information and Support
Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms].
Incident Response Assistance | Coordination with External Providers
(a) Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and (b) Identify organizational incident response team...
Incident Response Plan
a. Develop an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability; 2. Describes the structure and organization of the incident re...
Incident Response Plan | Breaches
Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a) A process to determine if notice to individuals or other organizations, including ov...
Information Spillage Response
Respond to information spills by: a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills; b. Identifying the specific information i...
Information Spillage Response | Responsible Personnel
[Withdrawn: Incorporated into IR-9.]
Information Spillage Response | Training
Provide information spillage response training [Assignment: organization-defined frequency].
Information Spillage Response | Post-spill Operations
Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective...
Information Spillage Response | Exposure to Unauthorized Personnel
Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] maintenan...
Controlled Maintenance
a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b. A...
Controlled Maintenance | Record Content
[Withdrawn: Incorporated into MA-2.]
Controlled Maintenance | Automated Maintenance Activities
(a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined automated mechanisms]; and (b) Produce up-to date, accurate, and...
Maintenance Tools
a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approved system maintenance tools [Assignment: organization-defined frequency].
Maintenance Tools | Inspect Tools
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
Maintenance Tools | Inspect Media
Check media containing diagnostic and test programs for malicious code before the media are used in the system.
Maintenance Tools | Prevent Unauthorized Removal
Prevent the removal of maintenance equipment containing organizational information by: (a) Verifying that there is no organizational information contained on the equipment; (b) Sanitizing or destroyin...
Maintenance Tools | Restricted Tool Use
Restrict the use of maintenance tools to authorized personnel only.
Maintenance Tools | Execution with Privilege
Monitor the use of maintenance tools that execute with increased privilege.
Maintenance Tools | Software Updates and Patches
Inspect maintenance tools to ensure the latest software updates and patches are installed.
Nonlocal Maintenance
a. Approve and monitor nonlocal maintenance and diagnostic activities; b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the...
Nonlocal Maintenance | Logging and Review
(a) Log [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions; and (b) Review the audit records of the maintenance and diagnostic sessions to detect anomalou...
Nonlocal Maintenance | Document Nonlocal Maintenance
[Withdrawn: Incorporated into MA-1 and MA-4.]
Nonlocal Maintenance | Comparable Security and Sanitization
(a) Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or...
Nonlocal Maintenance | Authentication and Separation of Maintenance Sessions
Protect nonlocal maintenance sessions by: (a) Employing [Assignment: organization-defined authenticators that are replay resistant]; and (b) Separating the maintenance sessions from other network sess...
Nonlocal Maintenance | Approvals and Notifications
(a) Require the approval of each nonlocal maintenance session by [Assignment: organization-defined personnel or roles]; and (b) Notify the following personnel or roles of the date and time of planned...
Nonlocal Maintenance | Cryptographic Protection
Implement the following cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications: [Assignment: organization-defined cryptographic mec...
Nonlocal Maintenance | Disconnect Verification
Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.
Maintenance Personnel
a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel; b. Verify that non-escorted personnel performing maintenance on...
Maintenance Personnel | Individuals Without Appropriate Access
(a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements: (1) Maintenance personnel who...
Maintenance Personnel | Security Clearances for Classified Systems
Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals f...
Maintenance Personnel | Citizenship Requirements for Classified Systems
Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.
Maintenance Personnel | Foreign Nationals
Ensure that: (a) Foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and oper...
Maintenance Personnel | Non-system Maintenance
Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorizations.
Timely Maintenance
Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure.
Timely Maintenance | Preventive Maintenance
Perform preventive maintenance on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].
Timely Maintenance | Predictive Maintenance
Perform predictive maintenance on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].
Timely Maintenance | Automated Support for Predictive Maintenance
Transfer predictive maintenance data to a maintenance management system using [Assignment: organization-defined automated mechanisms].
Field Maintenance
Restrict or prohibit field maintenance on [Assignment: organization-defined systems or system components] to [Assignment: organization-defined trusted maintenance facilities].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] media pro...
Media Access
Restrict access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
Media Access | Automated Restricted Access
[Withdrawn: Incorporated into MP-4(2).]
Media Access | Cryptographic Protection
[Withdrawn: Incorporated into SC-28(1).]
Media Marking
a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and b. Exempt [Assignment: organization-defined types of s...
Media Storage
a. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and b. Protect system...
Media Storage | Cryptographic Protection
[Withdrawn: Incorporated into SC-28(1).]
Media Storage | Automated Restricted Access
Restrict access to media storage areas and log access attempts and access granted using [Assignment: organization-defined automated mechanisms].
Media Transport
a. Protect and control [Assignment: organization-defined types of system media] during transport outside of controlled areas using [Assignment: organization-defined controls]; b. Maintain accountabili...
Media Transport | Protection Outside of Controlled Areas
[Withdrawn: Incorporated into MP-5.]
Media Transport | Documentation of Activities
[Withdrawn: Incorporated into MP-5.]
Media Transport | Custodians
Employ an identified custodian during transport of system media outside of controlled areas.
Media Transport | Cryptographic Protection
[Withdrawn: Incorporated into SC-28(1).]
Media Sanitization
a. Sanitize [Assignment: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniqu...
Media Sanitization | Review, Approve, Track, Document, and Verify
Review, approve, track, document, and verify media sanitization and disposal actions.
Media Sanitization | Equipment Testing
Test sanitization equipment and procedures [Assignment: organization-defined frequency] to ensure that the intended sanitization is being achieved.
Media Sanitization | Nondestructive Techniques
Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: [Assignment: organization-defined circumstanc...
Media Sanitization | Controlled Unclassified Information
[Withdrawn: Incorporated into MP-6.]
Media Sanitization | Classified Information
[Withdrawn: Incorporated into MP-6.]
Media Sanitization | Media Destruction
[Withdrawn: Incorporated into MP-6.]
Media Sanitization | Dual Authorization
Enforce dual authorization for the sanitization of [Assignment: organization-defined system media].
Media Sanitization | Remote Purging or Wiping of Information
Provide the capability to purge or wipe information from [Assignment: organization-defined systems or system components] [Selection: remotely; under the following conditions: [Assignment: organization...
Media Use
a. [Selection: Restrict; Prohibit] the use of [Assignment: organization-defined types of system media] on [Assignment: organization-defined systems or system components] using [Assignment: organizatio...
Media Use | Prohibit Use Without Owner
[Withdrawn: Incorporated into MP-7.]
Media Use | Prohibit Use of Sanitization-resistant Media
Prohibit the use of sanitization-resistant media in organizational systems.
Media Downgrading
a. Establish [Assignment: organization-defined system media downgrading process] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or c...
Media Downgrading | Documentation of Process
Document system media downgrading actions.
Media Downgrading | Equipment Testing
Test downgrading equipment and procedures [Assignment: organization-defined frequency] to ensure that downgrading actions are being achieved.
Media Downgrading | Controlled Unclassified Information
Downgrade system media containing controlled unclassified information prior to public release.
Media Downgrading | Classified Information
Downgrade system media containing classified information prior to release to individuals without required access authorizations.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] personall...
Authority to Process Personally Identifiable Information
a. Determine and document the [Assignment: organization-defined authority] that permits the [Assignment: organization-defined processing] of personally identifiable information; and b. Restrict the [A...
Authority to Process Personally Identifiable Information | Data Tagging
Attach data tags containing [Assignment: organization-defined authorized processing] to [Assignment: organization-defined elements of personally identifiable information].
Authority to Process Personally Identifiable Information | Automation
Manage enforcement of the authorized processing of personally identifiable information using [Assignment: organization-defined automated mechanisms].
Personally Identifiable Information Processing Purposes
a. Identify and document the [Assignment: organization-defined purpose(s)] for processing personally identifiable information; b. Describe the purpose(s) in the public privacy notices and policies of...
Personally Identifiable Information Processing Purposes | Data Tagging
Attach data tags containing the following purposes to [Assignment: organization-defined elements of personally identifiable information]: [Assignment: organization-defined processing purposes].
Personally Identifiable Information Processing Purposes | Automation
Track processing purposes of personally identifiable information using [Assignment: organization-defined automated mechanisms].
Consent
Implement [Assignment: organization-defined tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate indiv...
Consent | Tailored Consent
Provide [Assignment: organization-defined mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
Consent | Just-in-time Consent
Present [Assignment: organization-defined consent mechanisms] to individuals at [Assignment: organization-defined frequency] and in conjunction with [Assignment: organization-defined personally identi...
Consent | Revocation
Implement [Assignment: organization-defined tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.
Privacy Notice
Provide notice to individuals about the processing of personally identifiable information that: a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignm...
Privacy Notice | Just-in-time Notice
Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data a...
Privacy Notice | Privacy Act Statements
Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by...
System of Records Notice
For systems that process information that will be maintained in a Privacy Act system of records: a. Draft system of records notices in accordance with OMB guidance and submit new and significantly mod...
System of Records Notice | Routine Uses
Review all routine uses published in the system of records notice at [Assignment: organization-defined frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatibl...
System of Records Notice | Exemption Rules
Review all Privacy Act exemptions claimed for the system of records at [Assignment: organization-defined frequency] to ensure they remain appropriate and necessary in accordance with law, that they ha...
Specific Categories of Personally Identifiable Information
Apply [Assignment: organization-defined processing conditions] for specific categories of personally identifiable information.
Specific Categories of Personally Identifiable Information | Social Security Numbers
When a system processes Social Security numbers: (a) Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;...
Specific Categories of Personally Identifiable Information | First Amendment Information
Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent...
Computer Matching Requirements
When a system or organization processes information for the purpose of conducting a matching program: a. Obtain approval from the Data Integrity Board to conduct the matching program; b. Develop and e...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] personnel...
Position Risk Designation
a. Assign a risk designation to all organizational positions; b. Establish screening criteria for individuals filling those positions; and c. Review and update position risk designations [Assignment:...
Personnel Screening
a. Screen individuals prior to authorizing access to the system; and b. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreenin...
Personnel Screening | Classified Information
Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which the...
Personnel Screening | Formal Indoctrination
Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant type...
Personnel Screening | Information Requiring Special Protective Measures
Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: (a) Have valid access authorizations that are demonstrated by assigned officia...
Personnel Screening | Citizenship Requirements
Verify that individuals accessing a system processing, storing, or transmitting [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].
Personnel Termination
Upon termination of individual employment: a. Disable system access within [Assignment: organization-defined time period]; b. Terminate or revoke any authenticators and credentials associated with the...
Personnel Termination | Post-employment Requirements
(a) Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and (b) Require terminated individuals to sign an acknow...
Personnel Termination | Automated Actions
Use [Assignment: organization-defined automated mechanisms] to [Selection (one or more): notify [Assignment: organization-defined personnel or roles] of individual termination actions; disable access...
Personnel Transfer
a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within...
Access Agreements
a. Develop and document access agreements for organizational systems; b. Review and update the access agreements [Assignment: organization-defined frequency]; and c. Verify that individuals requiring...
Access Agreements | Information Requiring Special Protection
[Withdrawn: Incorporated into PS-3.]
Access Agreements | Classified Information Requiring Special Protection
Verify that access to classified information requiring special protection is granted only to individuals who: (a) Have a valid access authorization that is demonstrated by assigned official government...
Access Agreements | Post-employment Requirements
(a) Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information; and (b) Require individuals to sign an acknowledgment of these requirem...
External Personnel Security
a. Establish personnel security requirements, including security roles and responsibilities for external providers; b. Require external providers to comply with personnel security policies and procedu...
Personnel Sanctions
a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and b. Notify [Assignment: organization-defined person...
Position Descriptions
Incorporate security and privacy roles and responsibilities into organizational position descriptions.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] physical...
Emergency Shutoff
a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations; b. Place emergency shutoff switches or devices in...
Emergency Shutoff | Accidental and Unauthorized Activation
[Withdrawn: Incorporated into PE-10.]
Emergency Power
Provide an uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary powe...
Emergency Power | Alternate Power Supply — Minimal Operational Capability
Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss...
Emergency Power | Alternate Power Supply — Self-contained
Provide an alternate power supply for the system that is activated [Selection: manually; automatically] and that is: (a) Self-contained; (b) Not reliant on external power generation; and (c) Capable o...
Emergency Lighting
Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
Emergency Lighting | Essential Mission and Business Functions
Provide emergency lighting for all areas within the facility supporting essential mission and business functions.
Fire Protection
Employ and maintain fire detection and suppression systems that are supported by an independent energy source.
Fire Protection | Detection Systems — Automatic Activation and Notification
Employ fire detection systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] in the event of a...
Fire Protection | Suppression Systems — Automatic Activation and Notification
(a) Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders]; and (b) Em...
Fire Protection | Automatic Fire Suppression
[Withdrawn: Incorporated into PE-13(2).]
Fire Protection | Inspections
Ensure that the facility undergoes [Assignment: organization-defined frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assi...
Environmental Controls
a. Maintain [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control]] levels within the facility where the system resides at [Assi...
Environmental Controls | Automatic Controls
Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [Assignment: organization-defined automatic environmental controls].
Environmental Controls | Monitoring with Alarms and Notifications
Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: organization-defined personnel or roles].
Water Damage Protection
Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
Water Damage Protection | Automation Support
Detect the presence of water near the system and alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms].
Delivery and Removal
a. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility; and b. Maintain records of the system components.
Alternate Work Site
a. Determine and document the [Assignment: organization-defined alternate work sites] allowed for use by employees; b. Employ the following controls at alternate work sites: [Assignment: organization-...
Location of System Components
Position system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized...
Location of System Components | Facility Site
[Withdrawn: Moved to PE-23.]
Information Leakage
Protect the system from information leakage due to electromagnetic signals emanations.
Information Leakage | National Emissions Policies and Procedures
Protect system components, associated data communications, and networks in accordance with national Emissions Security policies and procedures based on the security category or classification of the i...
Physical Access Authorizations
a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b. Issue authorization credentials for facility access; c. Review the access li...
Physical Access Authorizations | Access by Position or Role
Authorize physical access to the facility where the system resides based on position or role.
Physical Access Authorizations | Two Forms of Identification
Require two forms of identification from the following forms of identification for visitor access to the facility where the system resides: [Assignment: organization-defined list of acceptable forms o...
Physical Access Authorizations | Restrict Unescorted Access
Restrict unescorted access to the facility where the system resides to personnel with [Selection (one or more): security clearances for all information contained within the system; formal access autho...
Asset Monitoring and Tracking
Employ [Assignment: organization-defined asset location technologies] to track and monitor the location and movement of [Assignment: organization-defined assets] within [Assignment: organization-defin...
Electromagnetic Pulse Protection
Employ [Assignment: organization-defined protective measures] against electromagnetic pulse damage for [Assignment: organization-defined systems and system components].
Component Marking
Mark [Assignment: organization-defined system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardw...
Facility Location
a. Plan the location or site of the facility where the system resides considering physical and environmental hazards; and b. For existing facilities, consider the physical and environmental hazards in...
Physical Access Control
a. Enforce physical access authorizations at [Assignment: organization-defined entry and exit points to the facility where the system resides] by: 1. Verifying individual access authorizations before...
Physical Access Control | System Access
Enforce physical access authorizations to the system in addition to the physical access controls for the facility at [Assignment: organization-defined physical spaces containing one or more components...
Physical Access Control | Facility and Systems
Perform security checks [Assignment: organization-defined frequency] at the physical perimeter of the facility or system for exfiltration of information or removal of system components.
Physical Access Control | Continuous Guards
Employ guards to control [Assignment: organization-defined physical access points] to the facility where the system resides 24 hours per day, 7 days per week.
Physical Access Control | Lockable Casings
Use lockable physical casings to protect [Assignment: organization-defined system components] from unauthorized physical access.
Physical Access Control | Tamper Protection
Employ [Assignment: organization-defined anti-tamper technologies] to [Selection (one or more): detect; prevent] physical tampering or alteration of [Assignment: organization-defined hardware componen...
Physical Access Control | Facility Penetration Testing
[Withdrawn: Incorporated into CA-8.]
Physical Access Control | Physical Barriers
Limit access using physical barriers.
Physical Access Control | Access Control Vestibules
Employ access control vestibules at [Assignment: organization-defined locations within the facility].
Access Control for Transmission
Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls].
Access Control for Output Devices
Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output.
Access Control for Output Devices | Access to Output by Authorized Individuals
[Withdrawn: Incorporated into PE-5.]
Access Control for Output Devices | Link to Individual Identity
Link individual identity to receipt of output from output devices.
Access Control for Output Devices | Marking Output Devices
[Withdrawn: Incorporated into PE-22.]
Monitoring Physical Access
a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents; b. Review physical access logs [Assignment: organization-defined frequency] an...
Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment
Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.
Monitoring Physical Access | Automated Intrusion Recognition and Responses
Recognize [Assignment: organization-defined classes or types of intrusions] and initiate [Assignment: organization-defined response actions] using [Assignment: organization-defined automated mechanism...
Monitoring Physical Access | Video Surveillance
(a) Employ video surveillance of [Assignment: organization-defined operational areas]; (b) Review video recordings [Assignment: organization-defined frequency]; and (c) Retain video recordings for [As...
Monitoring Physical Access | Monitoring Physical Access to Systems
Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces containing one or more components of the system...
Visitor Control
[Withdrawn: Incorporated into PE-2 and PE-3.]
Visitor Access Records
a. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period]; b. Review visitor access records [Assignment: organization-defined frequ...
Visitor Access Records | Automated Records Maintenance and Review
Maintain and review visitor access records using [Assignment: organization-defined automated mechanisms].
Visitor Access Records | Physical Access Records
[Withdrawn: Incorporated into PE-2.]
Visitor Access Records | Limit Personally Identifiable Information Elements
Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].
Power Equipment and Cabling
Protect power equipment and power cabling for the system from damage and destruction.
Power Equipment and Cabling | Redundant Cabling
Employ redundant power cabling paths that are physically separated by [Assignment: organization-defined distance].
Power Equipment and Cabling | Automatic Voltage Controls
Employ automatic voltage controls for [Assignment: organization-defined critical system components].
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] planning...
Baseline Selection
Select a control baseline for the system.
Baseline Tailoring
Tailor the selected control baseline by applying specified tailoring actions.
System Security and Privacy Plans
a. Develop security and privacy plans for the system that: 1. Are consistent with the organization’s enterprise architecture; 2. Explicitly define the constituent system components; 3. Describe the op...
System Security and Privacy Plans | Concept of Operations
[Withdrawn: Incorporated into PL-7.]
System Security and Privacy Plans | Functional Architecture
[Withdrawn: Incorporated into PL-8.]
System Security and Privacy Plans | Plan and Coordinate with Other Organizational Entities
[Withdrawn: Incorporated into PL-2.]
System Security Plan Update
[Withdrawn: Incorporated into PL-2.]
Rules of Behavior
a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b....
Rules of Behavior | Social Media and External Site/application Usage Restrictions
Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information on public websites; and (c)...
Privacy Impact Assessment
[Withdrawn: Incorporated into RA-8.]
Security-related Activity Planning
[Withdrawn: Incorporated into PL-2.]
Concept of Operations
a. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy; and b. Review and upd...
Security and Privacy Architectures
a. Develop security and privacy architectures for the system that: 1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organization...
Security and Privacy Architectures | Defense in Depth
Design the security and privacy architectures for the system using a defense-in-depth approach that: (a) Allocates [Assignment: organization-defined controls] to [Assignment: organization-defined loca...
Security and Privacy Architectures | Supplier Diversity
Require that [Assignment: organization-defined controls] allocated to [Assignment: organization-defined locations and architectural layers] are obtained from different suppliers.
Central Management
Centrally manage [Assignment: organization-defined controls and related processes].
Information Security Program Plan
a. Develop and disseminate an organization-wide information security program plan that: 1. Provides an overview of the requirements for the security program and a description of the security program m...
Authorization Process
a. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes; b. Designate individuals to fulfill specific rol...
Mission and Business Process Definition
a. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals,...
Insider Threat Program
Implement an insider threat program that includes a cross-discipline insider threat incident handling team.
Security and Privacy Workforce
Establish a security and privacy workforce development and improvement program.
Testing, Training, and Monitoring
a. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: 1. Are developed...
Security and Privacy Groups and Associations
Establish and institutionalize contact with selected groups and associations within the security and privacy communities: a. To facilitate ongoing security and privacy education and training for organ...
Threat Awareness Program
Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
Threat Awareness Program | Automated Means for Sharing Threat Intelligence
Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.
Protecting Controlled Unclassified Information on External Systems
a. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented i...
Privacy Program Plan
a. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and: 1. Includes a description of the structure of the privacy program a...
Privacy Program Leadership Role
Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks...
Information Security Program Leadership Role
Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
Dissemination of Privacy Program Information
Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that: a. Ensures that the...
Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital Services
Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a) Are written in plain language and organized in a way that is easy to under...
Accounting of Disclosures
a. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: 1. Date, nature, and purpose of each disclosure; and 2. Name and address, or other cont...
Personally Identifiable Information Quality Management
Develop and document organization-wide policies and procedures for: a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information...
Data Governance Body
Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].
Data Integrity Board
Establish a Data Integrity Board to: a. Review proposals to conduct or participate in a matching program; and b. Conduct an annual review of all matching programs in which the agency has participated.
Minimization of Personally Identifiable Information Used in Testing, Training, and Research
a. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; b. Limit or minimize the amount of...
Complaint Management
Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a. Mechanisms that are ea...
Privacy Reporting
a. Develop [Assignment: organization-defined privacy reports] and disseminate to: 1. [Assignment: organization-defined oversight bodies] to demonstrate accountability with statutory, regulatory, and p...
Risk Framing
a. Identify and document: 1. Assumptions affecting risk assessments, risk responses, and risk monitoring; 2. Constraints affecting risk assessments, risk responses, and risk monitoring; 3. Priorities...
Risk Management Program Leadership Roles
a. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes...
Information Security and Privacy Resources
a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; b. Prepare docum...
Supply Chain Risk Management Strategy
a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; 1....
Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items
Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.
Continuous Monitoring Strategy
Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: a. Establishing the following organization-wide metrics to be monitored: [Assignm...
Purposing
Analyze [Assignment: organization-defined systems or systems components] supporting mission essential services or functions to ensure that the information resources are being used consistent with thei...
Plan of Action and Milestones Process
a. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems: 1. Are deve...
System Inventory
Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems.
System Inventory | Inventory of Personally Identifiable Information
Establish, maintain, and update [Assignment: organization-defined frequency] an inventory of all systems, applications, and projects that process personally identifiable information.
Measures of Performance
Develop, monitor, and report on the results of information security and privacy measures of performance.
Enterprise Architecture
Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations,...
Enterprise Architecture | Offloading
Offload [Assignment: organization-defined non-essential functions or services] to other systems, system components, or an external provider.
Critical Infrastructure Plan
Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.
Risk Management Strategy
a. Develops a comprehensive strategy to manage: 1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of orga...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] risk asse...
Threat Hunting
a. Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls...
Security Categorization
a. Categorize the system and information it processes, stores, and transmits; b. Document the security categorization results, including supporting rationale, in the security plan for the system; and...
Security Categorization | Impact-level Prioritization
Conduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels.
Risk Assessment
a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system; 2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, dis...
Risk Assessment | Supply Chain Risk Assessment
(a) Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services]; and (b) Update the supply chain risk assessment [Assignment: organizat...
Risk Assessment | Use of All-source Intelligence
Use all-source intelligence to assist in the analysis of risk.
Risk Assessment | Dynamic Threat Awareness
Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].
Risk Assessment | Predictive Cyber Analytics
Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined...
Risk Assessment Update
[Withdrawn: Incorporated into RA-3.]
Vulnerability Monitoring and Scanning
a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new...
Vulnerability Monitoring and Scanning | Update Tool Capability
[Withdrawn: Incorporated into RA-5.]
Vulnerability Monitoring and Scanning | Correlate Scanning Information
Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.
Vulnerability Monitoring and Scanning | Public Disclosure Program
Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.
Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
Update the system vulnerabilities to be scanned [Selection (one or more): [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported].
Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage
Define the breadth and depth of vulnerability scanning coverage.
Vulnerability Monitoring and Scanning | Discoverable Information
Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].
Vulnerability Monitoring and Scanning | Privileged Access
Implement privileged access authorization to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].
Vulnerability Monitoring and Scanning | Automated Trend Analyses
Compare the results of multiple vulnerability scans using [Assignment: organization-defined automated mechanisms].
Vulnerability Monitoring and Scanning | Automated Detection and Notification of Unauthorized Components
[Withdrawn: Incorporated into CM-8.]
Vulnerability Monitoring and Scanning | Review Historic Audit Logs
Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time peri...
Vulnerability Monitoring and Scanning | Penetration Testing and Analyses
[Withdrawn: Incorporated into CA-8.]
Technical Surveillance Countermeasures Survey
Employ a technical surveillance countermeasures survey at [Assignment: organization-defined locations] [Selection (one or more): [Assignment: organization-defined frequency]; when the following events...
Risk Response
Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.
Privacy Impact Assessments
Conduct privacy impact assessments for systems, programs, or other activities before: a. Developing or procuring information technology that processes personally identifiable information; and b. Initi...
Criticality Analysis
Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organizatio...
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] supply ch...
Inspection of Systems or Components
Inspect the following systems or system components [Selection (one or more): at random; at [Assignment: organization-defined frequency], upon [Assignment: organization-defined indications of need for...
Component Authenticity
a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b. Report counterfeit system component...
Component Authenticity | Anti-counterfeit Training
Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).
Component Authenticity | Configuration Control for Component Service and Repair
Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system...
Component Authenticity | Anti-counterfeit Scanning
Scan for counterfeit system components [Assignment: organization-defined frequency].
Component Disposal
Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods].
Supply Chain Risk Management Plan
a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of t...
Supply Chain Risk Management Plan | Establish SCRM Team
Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: or...
Supply Chain Controls and Processes
a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component] in co...
Supply Chain Controls and Processes | Diverse Supply Base
Employ a diverse set of sources for the following system components and services: [Assignment: organization-defined system components and services].
Supply Chain Controls and Processes | Limitation of Harm
Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: [Assignment: organization-defined controls].
Supply Chain Controls and Processes | Sub-tier Flow Down
Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
Provenance
Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: organization-defined systems, system components, and associated data].
Provenance | Identity
Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: [Assignment: organiz...
Provenance | Track and Trace
Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: [Assignment: organization-defined systems and critical syste...
Provenance | Validate as Genuine and Not Altered
Employ the following controls to validate that the system or system component received is genuine and has not been altered: [Assignment: organization-defined controls].
Provenance | Supply Chain Integrity — Pedigree
Employ [Assignment: organization-defined controls] and conduct [Assignment: organization-defined analysis] to ensure the integrity of the system and system components by validating the internal compos...
Acquisition Strategies, Tools, and Methods
Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined acquisition strate...
Acquisition Strategies, Tools, and Methods | Adequate Supply
Employ the following controls to ensure an adequate supply of [Assignment: organization-defined critical system components]: [Assignment: organization-defined controls].
Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or Update
Assess the system, system component, or system service prior to selection, acceptance, modification, or update.
Supplier Assessments and Reviews
Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].
Supplier Assessments and Reviews | Testing and Analysis
Employ [Selection (one or more): organizational analysis; independent third-party analysis; organizational testing; independent third-party testing] of the following supply chain elements, processes,...
Supply Chain Operations Security
Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [Assignment: organization-defined Operations...
Notification Agreements
Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compro...
Tamper Resistance and Detection
Implement a tamper protection program for the system, system component, or system service.
Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle
Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system an...
Network Disconnect
Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.
Trusted Path
a. Provide a [Selection: physically; logically] isolated trusted communications path for communications between the user and the trusted components of the system; and b. Permit users to invoke the tru...
Trusted Path | Irrefutable Communications Path
(a) Provide a trusted communications path that is irrefutably distinguishable from other communications paths; and (b) Initiate the trusted communications path for communications between the [Assignme...
Cryptographic Key Establishment and Management
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for...
Cryptographic Key Establishment and Management | Availability
Maintain availability of information in the event of the loss of cryptographic keys by users.
Cryptographic Key Establishment and Management | Symmetric Keys
Produce, control, and distribute symmetric cryptographic keys using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.
Cryptographic Key Establishment and Management | Asymmetric Keys
Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium...
Cryptographic Key Establishment and Management | PKI Certificates
[Withdrawn: Incorporated into SC-12(3).]
Cryptographic Key Establishment and Management | PKI Certificates / Hardware Tokens
[Withdrawn: Incorporated into SC-12(3).]
Cryptographic Key Establishment and Management | Physical Control of Keys
Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.
Cryptographic Protection
a. Determine the [Assignment: organization-defined cryptographic uses]; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-de...
Cryptographic Protection | FIPS-validated Cryptography
[Withdrawn: Incorporated into SC-13.]
Cryptographic Protection | NSA-approved Cryptography
[Withdrawn: Incorporated into SC-13.]
Cryptographic Protection | Individuals Without Formal Access Approvals
[Withdrawn: Incorporated into SC-13.]
Cryptographic Protection | Digital Signatures
[Withdrawn: Incorporated into SC-13.]
Public Access Protections
[Withdrawn: Incorporated into AC-2, AC-3, AC-5, AC-6, SI-3, SI-4, SI-5, SI-7, and SI-10.]
Collaborative Computing Devices and Applications
a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed];...
Collaborative Computing Devices and Applications | Physical or Logical Disconnect
Provide [Selection (one or more): physical; logical] disconnect of collaborative computing devices in a manner that supports ease of use.
Collaborative Computing Devices and Applications | Blocking Inbound and Outbound Communications Traffic
[Withdrawn: Incorporated into SC-7.]
Collaborative Computing Devices and Applications | Disabling and Removal in Secure Work Areas
Disable or remove collaborative computing devices and applications from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].
Collaborative Computing Devices and Applications | Explicitly Indicate Current Participants
Provide an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences].
Transmission of Security and Privacy Attributes
Associate [Assignment: organization-defined security and privacy attributes] with information exchanged between systems and between system components.
Transmission of Security and Privacy Attributes | Integrity Verification
Verify the integrity of transmitted security and privacy attributes.
Transmission of Security and Privacy Attributes | Anti-spoofing Mechanisms
Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.
Transmission of Security and Privacy Attributes | Cryptographic Binding
Implement [Assignment: organization-defined mechanisms or techniques] to bind security and privacy attributes to transmitted information.
Public Key Infrastructure Certificates
a. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and b. Include only approved trust...
Mobile Code
a. Define acceptable and unacceptable mobile code and mobile code technologies; and b. Authorize, monitor, and control the use of mobile code within the system.
Mobile Code | Identify Unacceptable Code and Take Corrective Actions
Identify [Assignment: organization-defined unacceptable mobile code] and take [Assignment: organization-defined corrective actions].
Mobile Code | Acquisition, Development, and Use
Verify that the acquisition, development, and use of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements].
Mobile Code | Prevent Downloading and Execution
Prevent the download and execution of [Assignment: organization-defined unacceptable mobile code].
Mobile Code | Prevent Automatic Execution
Prevent the automatic execution of mobile code in [Assignment: organization-defined software applications] and enforce [Assignment: organization-defined actions] prior to executing the code.
Mobile Code | Allow Execution Only in Confined Environments
Allow execution of permitted mobile code only in confined virtual machine environments.
Voice Over Internet Protocol
[Withdrawn: Technology-specific; addressed as any other technology or protocol.]
Separation of System and User Functionality
Separate user functionality, including user interface services, from system management functionality.
Separation of System and User Functionality | Interfaces for Non-privileged Users
Prevent the presentation of system management functionality at interfaces to non-privileged users.
Separation of System and User Functionality | Disassociability
Store state information from applications and software separately.
Secure Name/address Resolution Service (authoritative Source)
a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resoluti...
Secure Name/address Resolution Service (authoritative Source) | Child Subspaces
[Withdrawn: Incorporated into SC-20.]
Secure Name/address Resolution Service (authoritative Source) | Data Origin and Integrity
Provide data origin and integrity protection artifacts for internal name/address resolution queries.
Secure Name/address Resolution Service (recursive or Caching Resolver)
Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
Secure Name/address Resolution Service (recursive or Caching Resolver) | Data Origin and Integrity
[Withdrawn: Incorporated into SC-21.]
Architecture and Provisioning for Name/address Resolution Service
Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation.
Session Authenticity
Protect the authenticity of communications sessions.
Session Authenticity | Invalidate Session Identifiers at Logout
Invalidate session identifiers upon user logout or other session termination.
Session Authenticity | User-initiated Logouts and Message Displays
[Withdrawn: Incorporated into AC-12(1).]
Session Authenticity | Unique System-generated Session Identifiers
Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.
Session Authenticity | Unique Session Identifiers with Randomization
[Withdrawn: Incorporated into SC-23(3).]
Session Authenticity | Allowed Certificate Authorities
Only allow the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.
Fail in Known State
Fail to a [Assignment: organization-defined known system state] for the following failures on the indicated components while preserving [Assignment: organization-defined system state information] in f...
Thin Nodes
Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components].
Decoys
Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.
Decoys | Detection of Malicious Code
[Withdrawn: Incorporated into SC-35.]
Platform-independent Applications
Include within organizational systems the following platform independent applications: [Assignment: organization-defined platform-independent applications].
Protection of Information at Rest
Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].
Protection of Information at Rest | Cryptographic Protection
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignmen...
Protection of Information at Rest | Offline Storage
Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].
Protection of Information at Rest | Cryptographic Keys
Provide protected storage for cryptographic keys [Selection: [Assignment: organization-defined safeguards]; hardware-protected key store].
Heterogeneity
Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: organization-defined system components].
Heterogeneity | Virtualization Techniques
Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed [Assignment: organization-defined frequency].
Security Function Isolation
Isolate security functions from nonsecurity functions.
Security Function Isolation | Hardware Separation
Employ hardware separation mechanisms to implement security function isolation.
Security Function Isolation | Access and Flow Control Functions
Isolate security functions enforcing access and information flow control from nonsecurity functions and from other security functions.
Security Function Isolation | Minimize Nonsecurity Functionality
Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.
Security Function Isolation | Module Coupling and Cohesiveness
Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.
Security Function Isolation | Layered Structures
Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layer...
Concealment and Misdirection
Employ the following concealment and misdirection techniques for [Assignment: organization-defined systems] at [Assignment: organization-defined time periods] to confuse and mislead adversaries: [Assi...
Concealment and Misdirection | Virtualization Techniques
[Withdrawn: Incorporated into SC-29(1).]
Concealment and Misdirection | Randomness
Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.
Concealment and Misdirection | Change Processing and Storage Locations
Change the location of [Assignment: organization-defined processing and/or storage] [Selection: [Assignment: organization-defined time frequency]; at random time intervals]].
Concealment and Misdirection | Misleading Information
Employ realistic, but misleading information in [Assignment: organization-defined system components] about its security state or posture.
Concealment and Misdirection | Concealment of System Components
Employ the following techniques to hide or conceal [Assignment: organization-defined system components]: [Assignment: organization-defined techniques].
Covert Channel Analysis
a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and b. Est...
Covert Channel Analysis | Test Covert Channels for Exploitability
Test a subset of the identified covert channels to determine the channels that are exploitable.
Covert Channel Analysis | Maximum Bandwidth
Reduce the maximum bandwidth for identified covert [Selection (one or more): storage; timing] channels to [Assignment: organization-defined values].
Covert Channel Analysis | Measure Bandwidth in Operational Environments
Measure the bandwidth of [Assignment: organization-defined subset of identified covert channels] in the operational environment of the system.
System Partitioning
Partition the system into [Assignment: organization-defined system components] residing in separate [Selection: physical; logical] domains or environments based on [Assignment: organization-defined ci...
System Partitioning | Separate Physical Domains for Privileged Functions
Partition privileged functions into separate physical domains.
Transmission Preparation Integrity
[Withdrawn: Incorporated into SC-8.]
Non-modifiable Executable Programs
For [Assignment: organization-defined system components], load and execute: a. The operating environment from hardware-enforced, read-only media; and b. The following applications from hardware-enforc...
Non-modifiable Executable Programs | No Writable Storage
Employ [Assignment: organization-defined system components] with no writeable storage that is persistent across component restart or power on/off.
Non-modifiable Executable Programs | Integrity Protection on Read-only Media
Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media.
Non-modifiable Executable Programs | Hardware-based Protection
[Withdrawn: Moved to SC-51.]
External Malicious Code Identification
Include system components that proactively seek to identify network-based malicious code or malicious websites.
Distributed Processing and Storage
Distribute the following processing and storage components across multiple [Selection: physical locations; logical domains]: [Assignment: organization-defined processing and storage components].
Distributed Processing and Storage | Polling Techniques
(a) Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: [Assignment: organization-defined distributed processing and stor...
Distributed Processing and Storage | Synchronization
Synchronize the following duplicate systems or system components: [Assignment: organization-defined duplicate systems or system components].
Out-of-band Channels
Employ the following out-of-band channels for the physical delivery or electronic transmission of [Assignment: organization-defined information, system components, or devices] to [Assignment: organiza...
Out-of-band Channels | Ensure Delivery and Transmission
Employ [Assignment: organization-defined controls] to ensure that only [Assignment: organization-defined individuals or systems] receive the following information, system components, or devices: [Assi...
Operations Security
Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [Assignment: organization-defined operations security controls...
Process Isolation
Maintain a separate execution domain for each executing system process.
Process Isolation | Hardware Separation
Implement hardware separation mechanisms to facilitate process isolation.
Process Isolation | Separate Execution Domain Per Thread
Maintain a separate execution domain for each thread in [Assignment: organization-defined multi-threaded processing].
Information in Shared System Resources
Prevent unauthorized and unintended information transfer via shared system resources.
Information in Shared System Resources | Security Levels
[Withdrawn: Incorporated into SC-4.]
Information in Shared System Resources | Multilevel or Periods Processing
Prevent unauthorized information transfer via shared resources in accordance with [Assignment: organization-defined procedures] when system processing explicitly switches between different information...
Wireless Link Protection
Protect external and internal [Assignment: organization-defined wireless links] from the following signal parameter attacks: [Assignment: organization-defined types of signal parameter attacks or refe...
Wireless Link Protection | Electromagnetic Interference
Implement cryptographic mechanisms that achieve [Assignment: organization-defined level of protection] against the effects of intentional electromagnetic interference.
Wireless Link Protection | Reduce Detection Potential
Implement cryptographic mechanisms to reduce the detection potential of wireless links to [Assignment: organization-defined level of reduction].
Wireless Link Protection | Imitative or Manipulative Communications Deception
Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
Wireless Link Protection | Signal Parameter Identification
Implement cryptographic mechanisms to prevent the identification of [Assignment: organization-defined wireless transmitters] by using the transmitter signal parameters.
Port and I/O Device Access
[Selection: Physically; Logically] disable or remove [Assignment: organization-defined connection ports or input/output devices] on the following systems or system components: [Assignment: organizatio...
Sensor Capability and Data
a. Prohibit [Selection (one or more): the use of devices possessing [Assignment: organization-defined environmental sensing capabilities] in [Assignment: organization-defined facilities, areas, or sys...
Sensor Capability and Data | Reporting to Authorized Individuals or Roles
Verify that the system is configured so that data or information collected by the [Assignment: organization-defined sensors] is only reported to authorized individuals or roles.
Sensor Capability and Data | Authorized Use
Employ the following measures so that data or information collected by [Assignment: organization-defined sensors] is only used for authorized purposes: [Assignment: organization-defined measures].
Sensor Capability and Data | Prohibit Use of Devices
[Withdrawn: Incorporated into SC-42.]
Sensor Capability and Data | Notice of Collection
Employ the following measures to facilitate an individual’s awareness that personally identifiable information is being collected by [Assignment: organization-defined sensors]: [Assignment: organizati...
Sensor Capability and Data | Collection Minimization
Employ [Assignment: organization-defined sensors] that are configured to minimize the collection of information about individuals that is not needed.
Usage Restrictions
a. Establish usage restrictions and implementation guidelines for the following system components: [Assignment: organization-defined system components]; and b. Authorize, monitor, and control the use...
Detonation Chambers
Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location].
System Time Synchronization
Synchronize system clocks within and between systems and system components.
System Time Synchronization | Synchronization with Authoritative Time Source
(a) Compare the internal system clocks [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source]; and (b) Synchronize the internal system clocks to...
System Time Synchronization | Secondary Authoritative Time Source
(a) Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source; and (b) Synchronize the internal system clocks to the secondary...
Cross Domain Policy Enforcement
Implement a policy enforcement mechanism [Selection: physically; logically] between the physical and/or network interfaces for the connecting security domains.
Alternate Communications Paths
Establish [Assignment: organization-defined alternate communications paths] for system operations organizational command and control.
Sensor Relocation
Relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organizati...
Sensor Relocation | Dynamic Relocation of Sensors or Monitoring Capabilities
Dynamically relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment...
Hardware-enforced Separation and Policy Enforcement
Implement hardware-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains].
Denial-of-service Protection
a. [Selection: Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events]; and b. Employ the following...
Denial-of-service Protection | Restrict Ability to Attack Other Systems
Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignment: organization-defined denial-of-service attacks].
Denial-of-service Protection | Capacity, Bandwidth, and Redundancy
Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.
Denial-of-service Protection | Detection and Monitoring
(a) Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [Assignment: organization-defined monitoring tools]; and (b) Monitor...
Software-enforced Separation and Policy Enforcement
Implement software-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains].
Hardware-based Protection
a. Employ hardware-based, write-protect for [Assignment: organization-defined system firmware components]; and b. Implement specific procedures for [Assignment: organization-defined authorized individ...
Resource Availability
Protect the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more): priority; quota; [Assignment: organization-defined controls]].
Boundary Protection
a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system...
Boundary Protection | Physically Separated Subnetworks
[Withdrawn: Incorporated into SC-7.]
Boundary Protection | Prevent Exfiltration
(a) Prevent the exfiltration of information; and (b) Conduct exfiltration tests [Assignment: organization-defined frequency].
Boundary Protection | Restrict Incoming Communications Traffic
Only allow incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].
Boundary Protection | Host-based Protection
Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].
Boundary Protection | Isolation of Security Tools, Mechanisms, and Support Components
Isolate [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with man...
Boundary Protection | Protect Against Unauthorized Physical Connections
Protect against unauthorized physical connections at [Assignment: organization-defined managed interfaces].
Boundary Protection | Networked Privileged Accesses
Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
Boundary Protection | Prevent Discovery of System Components
Prevent the discovery of specific system components that represent a managed interface.
Boundary Protection | Automated Enforcement of Protocol Formats
Enforce adherence to protocol formats.
Boundary Protection | Fail Secure
Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.
Boundary Protection | Block Communication from Non-organizationally Configured Hosts
Block inbound and outbound communications traffic between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers.
Boundary Protection | Public Access
[Withdrawn: Incorporated into SC-7.]
Boundary Protection | Dynamic Isolation and Segregation
Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.
Boundary Protection | Isolation of System Components
Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].
Boundary Protection | Separate Subnets for Connecting to Different Security Domains
Implement separate network addresses to connect to systems in different security domains.
Boundary Protection | Disable Sender Feedback on Protocol Validation Failure
Disable feedback to senders on protocol format validation failure.
Boundary Protection | Personally Identifiable Information
For systems that process personally identifiable information: (a) Apply the following processing rules to data elements of personally identifiable information: [Assignment: organization-defined proces...
Boundary Protection | Unclassified National Security System Connections
Prohibit the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protecti...
Boundary Protection | Classified National Security System Connections
Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device].
Boundary Protection | Unclassified Non-national Security System Connections
Prohibit the direct connection of [Assignment: organization-defined unclassified non-national security system] to an external network without the use of [Assignment: organization-defined boundary prot...
Boundary Protection | Connections to Public Networks
Prohibit the direct connection of [Assignment: organization-defined system] to a public network.
Boundary Protection | Separate Subnets to Isolate Functions
Implement [Selection: physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: organization-defined critical system components and fu...
Boundary Protection | Access Points
Limit the number of external network connections to the system.
Boundary Protection | External Telecommunications Services
(a) Implement a managed interface for each external telecommunication service; (b) Establish a traffic flow policy for each managed interface; (c) Protect the confidentiality and integrity of the info...
Boundary Protection | Deny by Default — Allow by Exception
Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].
Boundary Protection | Response to Recognized Failures
[Withdrawn: Incorporated into SC-7(18).]
Boundary Protection | Split Tunneling for Remote Devices
Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].
Boundary Protection | Route Traffic to Authenticated Proxy Servers
Route [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.
Boundary Protection | Restrict Threatening Outgoing Communications Traffic
(a) Detect and deny outgoing communications traffic posing a threat to external systems; and (b) Audit the identity of internal users associated with denied communications.
Transmission Confidentiality and Integrity
Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.
Transmission Confidentiality and Integrity | Cryptographic Protection
Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.
Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling
Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.
Transmission Confidentiality and Integrity | Cryptographic Protection for Message Externals
Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].
Transmission Confidentiality and Integrity | Conceal or Randomize Communications
Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].
Transmission Confidentiality and Integrity | Protected Distribution System
Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmissi...
Transmission Confidentiality
[Withdrawn: Incorporated into SC-8.]
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system an...
Information Input Validation
Check the validity of the following information inputs: [Assignment: organization-defined information inputs to the system].
Information Input Validation | Manual Override Capability
(a) Provide a manual override capability for input validation of the following information inputs: [Assignment: organization-defined inputs defined in the base control (SI-10)]; (b) Restrict the use o...
Information Input Validation | Review and Resolve Errors
Review and resolve input validation errors within [Assignment: organization-defined time period].
Information Input Validation | Predictable Behavior
Verify that the system behaves in a predictable and documented manner when invalid inputs are received.
Information Input Validation | Timing Interactions
Account for timing interactions among system components in determining appropriate responses for invalid inputs.
Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats
Restrict the use of information inputs to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].
Information Input Validation | Injection Prevention
Prevent untrusted data injections.
Error Handling
a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b. Reveal error messages only to [Assignment: organizati...
Information Management and Retention
Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines an...
Information Management and Retention | Limit Personally Identifiable Information Elements
Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignment: organization-defined elements of...
Information Management and Retention | Minimize Personally Identifiable Information in Testing, Training, and Research
Use the following techniques to minimize the use of personally identifiable information for research, testing, or training: [Assignment: organization-defined techniques].
Information Management and Retention | Information Disposal
Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].
Predictable Failure Prevention
a. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: organization-defined system components]; and b. Provide substitute syst...
Predictable Failure Prevention | Transferring Component Responsibilities
Take system components out of service by transferring component responsibilities to substitute components no later than [Assignment: organization-defined fraction or percentage] of mean time to failur...
Predictable Failure Prevention | Time Limit on Process Execution Without Supervision
[Withdrawn: Incorporated into SI-7(16).]
Predictable Failure Prevention | Manual Transfer Between Components
Manually initiate transfers between active and standby system components when the use of the active component reaches [Assignment: organization-defined percentage] of the mean time to failure.
Predictable Failure Prevention | Standby Component Installation and Notification
If system component failures are detected: (a) Ensure that the standby components are successfully and transparently installed within [Assignment: organization-defined time period]; and (b) [Selection...
Predictable Failure Prevention | Failover Capability
Provide [Selection: real-time; near real-time] [Assignment: organization-defined failover capability] for the system.
Non-persistence
Implement non-persistent [Assignment: organization-defined system components and services] that are initiated in a known state and terminated [Selection (one or more): upon end of session of use; peri...
Non-persistence | Refresh from Trusted Sources
Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignment: organization-defined trusted sources].
Non-persistence | Non-persistent Information
(a) [Selection: Refresh [Assignment: organization-defined information][Assignment: organization-defined frequency]; Generate [Assignment: organization-defined information] on demand]; and (b) Delete i...
Non-persistence | Non-persistent Connectivity
Establish connections to the system on demand and terminate connections after [Selection: completion of a request; a period of non-use].
Information Output Filtering
Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: organization-defined software...
Memory Protection
Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls].
Fail-safe Procedures
Implement the indicated fail-safe procedures when the indicated failures occur: [Assignment: organization-defined list of failure conditions and associated fail-safe procedures].
Personally Identifiable Information Quality Operations
a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency]; and b. Correct or...
Personally Identifiable Information Quality Operations | Automation Support
Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: organization-defined auto...
Personally Identifiable Information Quality Operations | Data Tags
Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
Personally Identifiable Information Quality Operations | Collection
Collect personally identifiable information directly from the individual.
Personally Identifiable Information Quality Operations | Individual Requests
Correct or delete personally identifiable information upon request by individuals or their designated representatives.
Personally Identifiable Information Quality Operations | Notice of Correction or Deletion
Notify [Assignment: organization-defined recipients of personally identifiable information] and individuals that the personally identifiable information has been corrected or deleted.
De-identification
a. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements of personally identifiable information]; and b. Evaluate [Assignment:...
De-identification | Collection
De-identify the dataset upon collection by not collecting personally identifiable information.
De-identification | Archiving
Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
De-identification | Release
Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
De-identification | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
De-identification | Statistical Disclosure Control
Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
De-identification | Differential Privacy
Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
De-identification | Validated Algorithms and Software
Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
De-identification | Motivated Intruder
Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Flaw Remediation
a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security-r...
Flaw Remediation | Central Management
[Withdrawn: Incorporated into PL-9.]
Flaw Remediation | Automated Flaw Remediation Status
Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined...
Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions
(a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks].
Flaw Remediation | Automated Patch Management Tools
Employ automated patch management tools to facilitate flaw remediation to the following system components: [Assignment: organization-defined system components].
Flaw Remediation | Automatic Software and Firmware Updates
Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].
Flaw Remediation | Removal of Previous Versions of Software and Firmware
Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.
Tainting
Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: organization...
Information Refresh
Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed.
Information Diversity
a. Identify the following alternative sources of information for [Assignment: organization-defined essential functions and services]: [Assignment: organization-defined alternative information sources]...
Information Fragmentation
Based on [Assignment: organization-defined circumstances]: a. Fragment the following information: [Assignment: organization-defined information]; and b. Distribute the fragmented information across th...
Malicious Code Protection
a. Implement [Selection (one or more): signature based; non-signature based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatical...
Malicious Code Protection | Central Management
[Withdrawn: Incorporated into PL-9.]
Malicious Code Protection | Malicious Code Analysis
(a) Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: [Assignment: organization-defined tools and techniques]; and (b) Incorporate the results fr...
Malicious Code Protection | Automatic Updates
[Withdrawn: Incorporated into SI-3.]
Malicious Code Protection | Non-privileged Users
[Withdrawn: Incorporated into AC-6(10).]
Malicious Code Protection | Updates Only by Privileged Users
Update malicious code protection mechanisms only when directed by a privileged user.
Malicious Code Protection | Portable Storage Devices
[Withdrawn: Incorporated into MP-7.]
Malicious Code Protection | Testing and Verification
(a) Test malicious code protection mechanisms [Assignment: organization-defined frequency] by introducing known benign code into the system; and (b) Verify that the detection of the code and the assoc...
Malicious Code Protection | Nonsignature-based Detection
[Withdrawn: Incorporated into SI-3.]
Malicious Code Protection | Detect Unauthorized Commands
(a) Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: organization-defined system hardware components]: [Assignment: orga...
Malicious Code Protection | Authenticate Remote Commands
[Withdrawn: Moved to AC-17(10).]
System Monitoring
a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and 2....
System Monitoring | System-wide Intrusion Detection System
Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.
System Monitoring | Visibility of Encrypted Communications
Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].
System Monitoring | Analyze Communications Traffic Anomalies
Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points within the system] to discover anomalies.
System Monitoring | Automated Organization-generated Alerts
Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with sec...
System Monitoring | Analyze Traffic and Event Patterns
(a) Analyze communications traffic and event patterns for the system; (b) Develop profiles representing common traffic and event patterns; and (c) Use the traffic and event profiles in tuning system-m...
System Monitoring | Wireless Intrusion Detection
Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
System Monitoring | Wireless to Wireline Communications
Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
System Monitoring | Correlate Monitoring Information
Correlate information from monitoring tools and mechanisms employed throughout the system.
System Monitoring | Integrated Situational Awareness
Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
System Monitoring | Analyze Traffic and Covert Exfiltration
Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interi...
System Monitoring | Risk for Individuals
Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.
System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
Employ automated tools and mechanisms to support near real-time analysis of events.
System Monitoring | Privileged Users
Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].
System Monitoring | Probationary Periods
Implement the following additional monitoring of individuals during [Assignment: organization-defined probationary period]: [Assignment: organization-defined additional monitoring].
System Monitoring | Unauthorized Network Services
(a) Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes]; and (b) [Selection (one or more): Audit; Alert [Assignm...
System Monitoring | Host-based Devices
Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].
System Monitoring | Indicators of Compromise
Discover, collect, and distribute to [Assignment: organization-defined personnel or roles], indicators of compromise provided by [Assignment: organization-defined sources].
System Monitoring | Optimize Network Traffic Analysis
Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
System Monitoring | Automated Tool and Mechanism Integration
Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.
System Monitoring | Inbound and Outbound Communications Traffic
(a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic; (b) Monitor inbound and outbound communications traffic [Assignment: organi...
System Monitoring | System-generated Alerts
Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise in...
System Monitoring | Restrict Non-privileged Users
[Withdrawn: Incorporated into AC-6(10).]
System Monitoring | Automated Response to Suspicious Events
(a) Notify [Assignment: organization-defined incident response personnel (identified by name and/or by role)] of detected suspicious events; and (b) Take the following actions upon detection: [Assignm...
System Monitoring | Protection of Monitoring Information
[Withdrawn: Incorporated into SI-4.]
System Monitoring | Testing of Monitoring Tools and Mechanisms
Test intrusion-monitoring tools and mechanisms [Assignment: organization-defined frequency].
Security Alerts, Advisories, and Directives
a. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis; b. Generate internal security alerts, advisories, and...
Security Alerts, Advisories, and Directives | Automated Alerts and Advisories
Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].
Security and Privacy Function Verification
a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): [Assignm...
Security and Privacy Function Verification | Notification of Failed Security Tests
[Withdrawn: Incorporated into SI-6.]
Security and Privacy Function Verification | Automation Support for Distributed Testing
Implement automated mechanisms to support the management of distributed security and privacy function testing.
Security and Privacy Function Verification | Report Verification Results
Report the results of security and privacy function verification to [Assignment: organization-defined personnel or roles].
Software, Firmware, and Information Integrity
a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and...
Software, Firmware, and Information Integrity | Integrity Checks
Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or s...
Software, Firmware, and Information Integrity | Protection of Boot Firmware
Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].
Software, Firmware, and Information Integrity | Confined Environments with Limited Privileges
[Withdrawn: Moved to CM-7(6).]
Software, Firmware, and Information Integrity | Integrity Verification
Require that the integrity of the following user-installed software be verified prior to execution: [Assignment: organization-defined user-installed software].
Software, Firmware, and Information Integrity | Code Execution in Protected Environments
[Withdrawn: Moved to CM-7(7).]
Software, Firmware, and Information Integrity | Binary or Machine Executable Code
[Withdrawn: Moved to CM-7(8).]
Software, Firmware, and Information Integrity | Code Authentication
Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].
Software, Firmware, and Information Integrity | Time Limit on Process Execution Without Supervision
Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].
Software, Firmware, and Information Integrity | Runtime Application Self-protection
Implement [Assignment: organization-defined controls] for application self-protection at runtime.
Software, Firmware, and Information Integrity | Automated Notifications of Integrity Violations
Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.
Software, Firmware, and Information Integrity | Centrally Managed Integrity Tools
Employ centrally managed integrity verification tools.
Software, Firmware, and Information Integrity | Tamper-evident Packaging
[Withdrawn: Incorporated into SR-9.]
Software, Firmware, and Information Integrity | Automated Response to Integrity Violations
Automatically [Selection (one or more): shut the system down; restart the system; implement [Assignment: organization-defined controls]] when integrity violations are discovered.
Software, Firmware, and Information Integrity | Cryptographic Protection
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
Software, Firmware, and Information Integrity | Integration of Detection and Response
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].
Software, Firmware, and Information Integrity | Auditing Capability for Significant Events
Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user;...
Software, Firmware, and Information Integrity | Verify Boot Process
Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].
Spam Protection
a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance w...
Spam Protection | Central Management
[Withdrawn: Incorporated into PL-9.]
Spam Protection | Automatic Updates
Automatically update spam protection mechanisms [Assignment: organization-defined frequency].
Spam Protection | Continuous Learning Capability
Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
Information Input Restrictions
[Withdrawn: Incorporated into AC-2, AC-3, AC-5, and AC-6.]
Policy and Procedures
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system an...
Developer Configuration Management
Require the developer of the system, system component, or system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; imp...
Developer Configuration Management | Software and Firmware Integrity Verification
Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.
Developer Configuration Management | Alternative Configuration Management Processes
Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
Developer Configuration Management | Hardware Integrity Verification
Require the developer of the system, system component, or system service to enable integrity verification of hardware components.
Developer Configuration Management | Trusted Generation
Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code...
Developer Configuration Management | Mapping Integrity for Version Control
Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hard...
Developer Configuration Management | Trusted Distribution
Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organizat...
Developer Configuration Management | Security and Privacy Representatives
Require [Assignment: organization-defined security and privacy representatives] to be included in the [Assignment: organization-defined configuration change management and control process].
Developer Testing and Evaluation
Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: a. Develop and implement a plan for ongoing security and p...
Developer Testing and Evaluation | Static Code Analysis
Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses
Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the syste...
Developer Testing and Evaluation | Independent Verification of Assessment Plans and Evidence
(a) Require an independent agent satisfying [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the...
Developer Testing and Evaluation | Manual Code Reviews
Require the developer of the system, system component, or system service to perform a manual code review of [Assignment: organization-defined specific code] using the following processes, procedures,...
Developer Testing and Evaluation | Penetration Testing
Require the developer of the system, system component, or system service to perform penetration testing: (a) At the following level of rigor: [Assignment: organization-defined breadth and depth of tes...
Developer Testing and Evaluation | Attack Surface Reviews
Require the developer of the system, system component, or system service to perform attack surface reviews.
Developer Testing and Evaluation | Verify Scope of Testing and Evaluation
Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level o...
Developer Testing and Evaluation | Dynamic Code Analysis
Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.
Developer Testing and Evaluation | Interactive Application Security Testing
Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.
Supply Chain Protection
[Withdrawn: Incorporated into SR Family.]
Supply Chain Protection | Acquisition Strategies / Tools / Methods
[Withdrawn: Moved to SR-5.]
Supply Chain Protection | Validate as Genuine and Not Altered
[Withdrawn: Moved to SR-4(3).]
Supply Chain Protection | Penetration Testing / Analysis of Elements, Processes, and Actors
[Withdrawn: Moved to SR-6(1).]
Supply Chain Protection | Inter-organizational Agreements
[Withdrawn: Moved to SR-8.]
Supply Chain Protection | Critical Information System Components
[Withdrawn: Incorporated into MA-6 and RA-9.]
Supply Chain Protection | Identity and Traceability
[Withdrawn: Moved to SR-4(1) and SR-4(2).]
Supply Chain Protection | Processes to Address Weaknesses or Deficiencies
[Withdrawn: Incorporated into SR-3.]
Supply Chain Protection | Supplier Reviews
[Withdrawn: Moved to SR-6.]
Supply Chain Protection | Trusted Shipping and Warehousing
[Withdrawn: Incorporated into SR-3.]
Supply Chain Protection | Diversity of Suppliers
[Withdrawn: Moved to SR-3(1).]
Supply Chain Protection | Limitation of Harm
[Withdrawn: Moved to SR-3(2).]
Supply Chain Protection | Minimizing Procurement Time
[Withdrawn: Incorporated into SR-5(1).]
Supply Chain Protection | Assessments Prior to Selection / Acceptance / Update
[Withdrawn: Moved to SR-5(2).]
Supply Chain Protection | Use of All-source Intelligence
[Withdrawn: Incorporated into RA-3(2).]
Supply Chain Protection | Operations Security
[Withdrawn: Moved to SR-7.]
Trustworthiness
[Withdrawn: Incorporated into SA-8.]
Criticality Analysis
[Withdrawn: Incorporated into RA-9.]
Criticality Analysis | Critical Components with No Viable Alternative Sourcing
[Withdrawn: Incorporated into SA-20.]
Development Process, Standards, and Tools
a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies th...
Development Process, Standards, and Tools | Quality Metrics
Require the developer of the system, system component, or system service to: (a) Define quality metrics at the beginning of the development process; and (b) Provide evidence of meeting the quality met...
Development Process, Standards, and Tools | Incident Response Plan
Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.
Development Process, Standards, and Tools | Archive System or Component
Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privac...
Development Process, Standards, and Tools | Minimize Personally Identifiable Information
Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.
Development Process, Standards, and Tools | Security and Privacy Tracking Tools
Require the developer of the system, system component, or system service to select and employ security and privacy tracking tools for use during the development process.
Development Process, Standards, and Tools | Criticality Analysis
Require the developer of the system, system component, or system service to perform a criticality analysis: (a) At the following decision points in the system development life cycle: [Assignment: orga...
Development Process, Standards, and Tools | Threat Modeling and Vulnerability Analysis
[Withdrawn: Incorporated into SA-11(2).]
Development Process, Standards, and Tools | Attack Surface Reduction
Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: organization-defined thresholds].
Development Process, Standards, and Tools | Continuous Improvement
Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.
Development Process, Standards, and Tools | Automated Vulnerability Analysis
Require the developer of the system, system component, or system service [Assignment: organization-defined frequency] to: (a) Perform an automated vulnerability analysis using [Assignment: organizatio...
Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information
Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current developme...
Development Process, Standards, and Tools | Use of Live Data
[Withdrawn: Incorporated into SA-3(2).]
Developer-provided Training
Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls,...
Developer Security and Privacy Architecture and Design
Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that: a. Is consistent with the organization’s security...
Developer Security and Privacy Architecture and Design | Formal Policy Model
Require the developer of the system, system component, or system service to: (a) Produce, as an integral part of the development process, a formal policy model describing the [Assignment: organization...
Developer Security and Privacy Architecture and Design | Security-relevant Components
Require the developer of the system, system component, or system service to: (a) Define security-relevant hardware, software, and firmware; and (b) Provide a rationale that the definition for security...
Developer Security and Privacy Architecture and Design | Formal Correspondence
Require the developer of the system, system component, or system service to: (a) Produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces...
Developer Security and Privacy Architecture and Design | Informal Correspondence
Require the developer of the system, system component, or system service to: (a) Produce, as an integral part of the development process, an informal descriptive top-level specification that specifies...
Developer Security and Privacy Architecture and Design | Conceptually Simple Design
Require the developer of the system, system component, or system service to: (a) Design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple prot...
Developer Security and Privacy Architecture and Design | Structure for Testing
Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate testing.
Developer Security and Privacy Architecture and Design | Structure for Least Privilege
Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.
Developer Security and Privacy Architecture and Design | Orchestration
Design [Assignment: organization-defined critical systems or system components] with coordinated behavior to implement the following capabilities: [Assignment: organization-defined capabilities, by sy...
Developer Security and Privacy Architecture and Design | Design Diversity
Use different designs for [Assignment: organization-defined critical systems or system components] to satisfy a common set of requirements or to provide equivalent functionality.
Tamper Resistance and Detection
[Withdrawn: Moved to SR-9.]
Tamper Resistance and Detection | Multiple Phases of System Development Life Cycle
[Withdrawn: Moved to SR-9(1).]
Tamper Resistance and Detection | Inspection of Systems or Components
[Withdrawn: Moved to SR-10.]
Component Authenticity
[Withdrawn: Moved to SR-11.]
Component Authenticity | Anti-counterfeit Training
[Withdrawn: Moved to SR-11(1).]
Component Authenticity | Configuration Control for Component Service and Repair
[Withdrawn: Moved to SR-11(2).]
Component Authenticity | Component Disposal
[Withdrawn: Moved to SR-12.]
Component Authenticity | Anti-counterfeit Scanning
[Withdrawn: Moved to SR-11(3).]
Allocation of Resources
a. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b. Determine, document, and allocate the resources...
Customized Development of Critical Components
Reimplement or custom develop the following critical system components: [Assignment: organization-defined critical system components].
Developer Screening
Require that the developer of [Assignment: organization-defined system, system component, or system service]: a. Has appropriate access authorizations as determined by assigned [Assignment: organizati...
Developer Screening | Validation of Screening
[Withdrawn: Incorporated into SA-21.]
Unsupported System Components
a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continu...
Unsupported System Components | Alternative Sources for Continued Support
[Withdrawn: Incorporated into SA-22.]
Specialization
Employ [Selection (one or more): design; modification; augmentation; reconfiguration] on [Assignment: organization-defined systems or system components] supporting mission essential services or functi...
System Development Life Cycle
a. Acquire, develop, and manage the system using [Assignment: organization-defined system development life cycle] that incorporates information security and privacy considerations; b. Define and docum...
System Development Life Cycle | Manage Preproduction Environment
Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.
System Development Life Cycle | Use of Live or Operational Data
(a) Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and (b) Protect preproduction environments for the system, sy...
System Development Life Cycle | Technology Refresh
Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.
Acquisition Process
Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection (one or more): standardized contract language; [Assignment: organization-defined contract l...
Acquisition Process | Functional Properties of Controls
Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.
Acquisition Process | Use of Approved PIV Products
Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.
Acquisition Process | System of Records
Include [Assignment: organization-defined Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mi...
Acquisition Process | Data Ownership
(a) Include organizational data ownership requirements in the acquisition contract; and (b) Require all data to be removed from the contractor’s system and returned to the organization within [Assignm...
Acquisition Process | Design and Implementation Information for Controls
Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection (one or more): security-relevant ex...
Acquisition Process | Development Methods, Techniques, and Practices
Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes: (a) [Assignment: organization-defined systems...
Acquisition Process | Assignment of Components to Systems
[Withdrawn: Incorporated into CM-8(9).]
Acquisition Process | System, Component, and Service Configurations
Require the developer of the system, system component, or system service to: (a) Deliver the system, component, or service with [Assignment: organization-defined security configurations] implemented;...
Acquisition Process | Use of Information Assurance Products
(a) Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to pr...
Acquisition Process | NIAP-approved Protection Profiles
(a) Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a Nat...
Acquisition Process | Continuous Monitoring Plan for Controls
Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program...
Acquisition Process | Functions, Ports, Protocols, and Services in Use
Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.
System Documentation
a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or s...
System Documentation | Functional Properties of Security Controls
[Withdrawn: Incorporated into SA-4(1).]
System Documentation | Security-relevant External System Interfaces
[Withdrawn: Incorporated into SA-4(2).]
System Documentation | High-level Design
[Withdrawn: Incorporated into SA-4(2).]
System Documentation | Low-level Design
[Withdrawn: Incorporated into SA-4(2).]
System Documentation | Source Code
[Withdrawn: Incorporated into SA-4(2).]
Software Usage Restrictions
[Withdrawn: Incorporated into CM-10 and SI-7.]
User-installed Software
[Withdrawn: Incorporated into CM-11 and SI-7.]
Security and Privacy Engineering Principles
Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: or...
Security and Privacy Engineering Principles | Clear Abstractions
Implement the security design principle of clear abstractions.
Security and Privacy Engineering Principles | Hierarchical Trust
Implement the security design principle of hierarchical trust in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Inverse Modification Threshold
Implement the security design principle of inverse modification threshold in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Hierarchical Protection
Implement the security design principle of hierarchical protection in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Minimized Security Elements
Implement the security design principle of minimized security elements in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Least Privilege
Implement the security design principle of least privilege in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Predicate Permission
Implement the security design principle of predicate permission in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Self-reliant Trustworthiness
Implement the security design principle of self-reliant trustworthiness in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Secure Distributed Composition
Implement the security design principle of secure distributed composition in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Trusted Communications Channels
Implement the security design principle of trusted communications channels in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Continuous Protection
Implement the security design principle of continuous protection in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Least Common Mechanism
Implement the security design principle of least common mechanism in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Secure Metadata Management
Implement the security design principle of secure metadata management in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Self-analysis
Implement the security design principle of self-analysis in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Accountability and Traceability
Implement the security design principle of accountability and traceability in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Secure Defaults
Implement the security design principle of secure defaults in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Secure Failure and Recovery
Implement the security design principle of secure failure and recovery in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Economic Security
Implement the security design principle of economic security in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Performance Security
Implement the security design principle of performance security in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Human Factored Security
Implement the security design principle of human factored security in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Acceptable Security
Implement the security design principle of acceptable security in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Repeatable and Documented Procedures
Implement the security design principle of repeatable and documented procedures in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Modularity and Layering
Implement the security design principles of modularity and layering in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Procedural Rigor
Implement the security design principle of procedural rigor in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Secure System Modification
Implement the security design principle of secure system modification in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Sufficient Documentation
Implement the security design principle of sufficient documentation in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Minimization
Implement the privacy principle of minimization using [Assignment: organization-defined processes].
Security and Privacy Engineering Principles | Partially Ordered Dependencies
Implement the security design principle of partially ordered dependencies in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Efficiently Mediated Access
Implement the security design principle of efficiently mediated access in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Minimized Sharing
Implement the security design principle of minimized sharing in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Reduced Complexity
Implement the security design principle of reduced complexity in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Secure Evolvability
Implement the security design principle of secure evolvability in [Assignment: organization-defined systems or system components].
Security and Privacy Engineering Principles | Trusted Components
Implement the security design principle of trusted components in [Assignment: organization-defined systems or system components].
External System Services
a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls]; b. De...
External System Services | Risk Assessments and Organizational Approvals
(a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and (b) Verify that the acquisition or outsourcing of dedicated information s...
External System Services | Identification of Functions, Ports, Protocols, and Services
Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: organization-defined ext...
External System Services | Establish and Maintain Trust Relationship with Providers
Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignment: organization-defined securit...
External System Services | Consistent Interests of Consumers and Providers
Take the following actions to verify that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests: [Assignment: organiza...
External System Services | Processing, Storage, and Service Location
Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defi...
External System Services | Organization-controlled Cryptographic Keys
Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.
External System Services | Organization-controlled Integrity Checking
Provide the capability to check the integrity of information while it resides in the external system.
External System Services | Processing and Storage Location — U.S. Jurisdiction
Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.