BaselineWatch
5149 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

DISA Control Correlation Identifiers (CCI) 2026-07-14

5149 requirements · published 2026-07-15
Changes in this version
AllPolicyTechnical
RefTitleText
CCI-000001 The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordinat… The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000002 Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope… Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and com
CCI-000003 Review and update the current access control policy on an organization-defined frequency. Review and update the current access control policy on an organization-defined frequency.
CCI-000004 The organization develops procedures to facilitate the implementation of the access control policy and associated access controls. The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.
CCI-000005 Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level acce… Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles.
CCI-000006 Review and update the current access control procedures on an organization-defined frequency. Review and update the current access control procedures on an organization-defined frequency.
CCI-000007 The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anon… The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary).
CCI-000008 The organization establishes conditions for group membership. The organization establishes conditions for group membership.
CCI-000009 The organization manages information system accounts by identifying authorized users of the information system and specifying access privil… The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges.
CCI-000010 Require approvals by organization-defined personnel or roles for requests to create accounts. Require approvals by organization-defined personnel or roles for requests to create accounts.
CCI-000011 Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures. Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures.
CCI-000012 Review accounts for compliance with account management requirements per organization-defined frequency. Review accounts for compliance with account management requirements per organization-defined frequency.
CCI-000013 The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when… The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/nee
CCI-000014 The organization manages information system accounts by granting access to the system based on a valid access authorization; intended syste… The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functio
CCI-000015 Support the management of system accounts using organization-defined automated mechanisms. Support the management of system accounts using organization-defined automated mechanisms.
CCI-000016 Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account. Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.
CCI-000017 Disable accounts when the accounts have been inactive for the organization-defined time-period. Disable accounts when the accounts have been inactive for the organization-defined time-period.
CCI-000018 Automatically audit account creation actions. Automatically audit account creation actions.
CCI-000019 Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out. Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out.
CCI-000020 The information system dynamically manages user privileges and associated access authorizations. The information system dynamically manages user privileges and associated access authorizations.
CCI-000021 Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions. Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions.
CCI-000022 The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set… The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.
CCI-000023 The organization develops an organization-wide information security program plan that provides sufficient information about the program man… The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and se
CCI-000024 Prevent access to organization-defined security-relevant information except during secure, non-operable system states. Prevent access to organization-defined security-relevant information except during secure, non-operable system states.
CCI-000025 The information system enforces information flow control using explicit security attributes on information, source, and destination objects… The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.
CCI-000026 Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions. Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.
CCI-000027 Enforce organization-defined information flow control policies. Enforce organization-defined information flow control policies.
CCI-000028 Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or m… Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or methods.
CCI-000029 Enforce organization-defined limitations on embedding data types within other data types. Enforce organization-defined limitations on embedding data types within other data types.
CCI-000030 Enforce information flow control based on organization-defined metadata. Enforce information flow control based on organization-defined metadata.
CCI-000031 Enforce one-way information flows using hardware-based flow control mechanisms. Enforce one-way information flows using hardware-based flow control mechanisms.
CCI-000032 Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-… Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.
CCI-000033 The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of… The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision.
CCI-000034 Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organizat… Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organization-defined conditions.
CCI-000035 Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support di… Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support different security or privacy policies.
CCI-000036 The organization separates organization-defined duties of individuals. The organization separates organization-defined duties of individuals.
CCI-000037 The organization implements separation of duties through assigned information system access authorizations. The organization implements separation of duties through assigned information system access authorizations.
CCI-000038 The organization explicitly authorizes access to organization-defined security functions and security-relevant information. The organization explicitly authorizes access to organization-defined security functions and security-relevant information.
CCI-000039 Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, u… Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts or roles, when accessing nonsecurity functions.
CCI-000040 The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-releva… The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.
CCI-000041 Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs. Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs.
CCI-000042 Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system. Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system.
CCI-000043 Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time pe… Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.
CCI-000044 Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period. Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
CCI-000045 The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period. The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.
CCI-000046 The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organizati… The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.
CCI-000047 The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccess… The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time perio
CCI-000048 Display an organization-defined system use notification message or banner to users before granting access to the system that provides priva… Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, polici
CCI-000049 The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy a… The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies,
CCI-000050 Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to… Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.
CCI-000051 The organization approves the information system use notification message before its use. The organization approves the information system use notification message before its use.
CCI-000052 Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access). Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).
CCI-000053 Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access. Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.
CCI-000054 Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number. Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.
CCI-000055 Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type. Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.
CCI-000056 Retain the device lock until the user reestablishes access using established identification and authentication procedures. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
CCI-000057 Prevent further access to the system by initiating a device lock after organization-defined time period of inactivity; and/or requiring the… Prevent further access to the system by initiating a device lock after organization-defined time period of inactivity; and/or requiring the user to initiate a device lock before leaving the system unattended.
CCI-000058 The information system provides the capability for users to directly initiate session lock mechanisms. The information system provides the capability for users to directly initiate session lock mechanisms.
CCI-000059 Defines the time-period of inactivity after which the system initiates a device lock. Defines the time-period of inactivity after which the system initiates a device lock.
CCI-000060 Conceal, via the device lock, information previously visible on the display with a publicly viewable image. Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
CCI-000061 Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with org… Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.
CCI-000062 The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish missi… The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.
CCI-000063 The organization defines allowed methods of remote access to the information system. The organization defines allowed methods of remote access to the information system.
CCI-000064 The organization establishes usage restrictions and implementation guidance for each allowed remote access method. The organization establishes usage restrictions and implementation guidance for each allowed remote access method.
CCI-000065 Authorize remote access to the system prior to allowing such connections. Authorize remote access to the system prior to allowing such connections.
CCI-000066 The organization enforces requirements for remote connections to the information system. The organization enforces requirements for remote connections to the information system.
CCI-000067 Employ automated mechanisms to monitor remote access methods. Employ automated mechanisms to monitor remote access methods.
CCI-000068 Implement cryptographic mechanisms to protect the confidentiality of remote access sessions. Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
CCI-000069 Route all remote accesses through authorized and managed network access control points. Route all remote accesses through authorized and managed network access control points.
CCI-000070 Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-define… Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs.
CCI-000071 The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency. The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.
CCI-000072 Protect information about remote access mechanisms from unauthorized use and disclosure. Protect information about remote access mechanisms from unauthorized use and disclosure.
CCI-000073 Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a… Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for
CCI-000074 Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability… Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and r
CCI-000075 Review and update the organization-wide information security program plan on an organization-defined frequency. Review and update the organization-wide information security program plan on an organization-defined frequency.
CCI-000076 Defines the frequency with which to review and update the organization-wide information security program plan. Defines the frequency with which to review and update the organization-wide information security program plan.
CCI-000077 The organization updates the plan to address organizational changes and problems identified during plan implementation or security control… The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments.
CCI-000078 Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organizatio… Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
CCI-000079 The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant inform… The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures.
CCI-000080 Include the resources needed to implement the information security programs in capital planning and investment requests and document all ex… Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement.
CCI-000081 The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required. The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.
CCI-000082 The organization establishes usage restrictions for organization-controlled mobile devices. The organization establishes usage restrictions for organization-controlled mobile devices.
CCI-000083 Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas. Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
CCI-000084 Authorize connection of mobile devices to organizational systems. Authorize connection of mobile devices to organizational systems.
CCI-000085 The organization monitors for unauthorized connections of mobile devices to organizational information systems. The organization monitors for unauthorized connections of mobile devices to organizational information systems.
CCI-000086 The organization enforces requirements for the connection of mobile devices to organizational information systems. The organization enforces requirements for the connection of mobile devices to organizational information systems.
CCI-000087 The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices w… The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.
CCI-000088 The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of sign… The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
CCI-000089 The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the orga… The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
CCI-000090 The organization restricts the use of writable, removable media in organizational information systems. The organization restricts the use of writable, removable media in organizational information systems.
CCI-000091 The organization prohibits the use of personally-owned, removable media in organizational information systems. The organization prohibits the use of personally-owned, removable media in organizational information systems.
CCI-000092 The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner. The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.
CCI-000093 Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external s… Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operatin
CCI-000094 The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, ope… The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process o
CCI-000095 The organization prohibits authorized individuals from using an external information system to access the information system except in situ… The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the exte
CCI-000096 The organization prohibits authorized individuals from using an external information system to access the information system or to process,… The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization h
CCI-000097 Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defin… Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions.
CCI-000098 Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information's access and use r… Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information's access and use restrictions for organization-defined information sharing circumstances where user discretion is requi
CCI-000099 Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorization… Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
CCI-000100 Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses pu… Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entit
CCI-000101 Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined pe… Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined personnel or roles.
CCI-000102 Review and update the current security awareness and training policy in accordance with organization-defined frequency. Review and update the current security awareness and training policy in accordance with organization-defined frequency.
CCI-000103 Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training… Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls.
CCI-000104 Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined p… Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined personnel or roles.
CCI-000105 Review and update the current security awareness and training procedures in accordance with an organization-defined frequency. Review and update the current security awareness and training procedures in accordance with an organization-defined frequency.
CCI-000106 Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial traini… Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.
CCI-000107 Provide practical exercises in literacy training that simulate events and incidents. Provide practical exercises in literacy training that simulate events and incidents.
CCI-000108 Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the sys… Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.
CCI-000109 Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes. Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes.
CCI-000110 The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordan… The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.
CCI-000111 The organization defines a frequency for providing refresher role-based security training. The organization defines a frequency for providing refresher role-based security training.
CCI-000112 Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system… Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.
CCI-000113 Document individual security training activities, including security awareness training and specific system security training. Document individual security training activities, including security awareness training and specific system security training.
CCI-000114 Monitor individual information security training activities, including security awareness training and specific security training. Monitor individual information security training activities, including security awareness training and specific security training.
CCI-000115 The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security edu… The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, a
CCI-000116 The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing securi… The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniq
CCI-000117 Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addres… Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational
CCI-000118 The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated a… The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities.
CCI-000119 Review and update the current audit and accountability policy on an organization-defined frequency. Review and update the current audit and accountability policy on an organization-defined frequency.
CCI-000120 Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountabi… Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
CCI-000121 The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability… The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities.
CCI-000122 Review and update the current audit and accountability procedures on an organization-defined frequency. Review and update the current audit and accountability procedures on an organization-defined frequency.
CCI-000123 Identify the organization-defined event types that the system is capable of logging in support of the audit function. Identify the organization-defined event types that the system is capable of logging in support of the audit function.
CCI-000124 Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the select… Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.
CCI-000125 Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of inc… Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of incidents.
CCI-000126 Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiri… Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type.
CCI-000127 The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency. The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency.
CCI-000128 The organization includes execution of privileged functions in the list of events to be audited by the information system. The organization includes execution of privileged functions in the list of events to be audited by the information system.
CCI-000129 The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mis… The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.
CCI-000130 Ensure that audit records contain information that establishes what type of event occurred. Ensure that audit records contain information that establishes what type of event occurred.
CCI-000131 Ensure that audit records containing information that establishes when the event occurred. Ensure that audit records containing information that establishes when the event occurred.
CCI-000132 Ensure that audit records containing information that establishes where the event occurred. Ensure that audit records containing information that establishes where the event occurred.
CCI-000133 Ensure that audit records containing information that establishes the source of the event. Ensure that audit records containing information that establishes the source of the event.
CCI-000134 Ensure that audit records containing information that establishes the outcome of the event. Ensure that audit records containing information that establishes the outcome of the event.
CCI-000135 Generate audit records containing the organization-defined additional information that is to be included in the audit records. Generate audit records containing the organization-defined additional information that is to be included in the audit records.
CCI-000136 The organization centrally manages the content of audit records generated by organization-defined information system components. The organization centrally manages the content of audit records generated by organization-defined information system components.
CCI-000137 The organization allocates audit record storage capacity. The organization allocates audit record storage capacity.
CCI-000138 The organization configures auditing to reduce the likelihood of storage capacity being exceeded. The organization configures auditing to reduce the likelihood of storage capacity being exceeded.
CCI-000139 Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure. Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
CCI-000140 Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the… Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.
CCI-000141 Make available for expenditure, the planned information security resources. Make available for expenditure, the planned information security resources.
CCI-000142 Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational sy… Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational systems are maintained.
CCI-000143 The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum… The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.
CCI-000144 The information system provides a real-time alert when organization-defined audit failure events occur. The information system provides a real-time alert when organization-defined audit failure events occur.
CCI-000145 Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or reject… Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or rejecting network traffic above those organization-defined thresholds.
CCI-000146 The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided. The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided.
CCI-000147 Defines the audit logging failure events requiring real-time alerts. Defines the audit logging failure events requiring real-time alerts.
CCI-000148 Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusu… Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.
CCI-000149 Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity. Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.
CCI-000150 The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to… The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation ba
CCI-000151 Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity. Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity.
CCI-000152 The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and… The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
CCI-000153 Analyze and correlate audit records across different repositories to gain organization-wide situational awareness. Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
CCI-000154 Provide the capability to centrally review and analyze audit records from multiple components within the system. Provide the capability to centrally review and analyze audit records from multiple components within the system.
CCI-000155 The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network mo… The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.
CCI-000156 The information system provides an audit reduction capability. The information system provides an audit reduction capability.
CCI-000157 The information system provides a report generation capability. The information system provides a report generation capability.
CCI-000158 Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within… Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
CCI-000159 Use internal system clocks to generate time stamps for audit records. Use internal system clocks to generate time stamps for audit records.
CCI-000160 The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined au… The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.
CCI-000161 The organization defines the frequency for the synchronization of internal information system clocks. The organization defines the frequency for the synchronization of internal information system clocks.
CCI-000162 Protect audit information from unauthorized access. Protect audit information from unauthorized access.
CCI-000163 Protect audit information from unauthorized modification. Protect audit information from unauthorized modification.
CCI-000164 Protect audit information from unauthorized deletion. Protect audit information from unauthorized deletion.
CCI-000165 Write audit records to hardware-enforced, write-once media. Write audit records to hardware-enforced, write-once media.
CCI-000166 Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organizatio… Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
CCI-000167 Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet… Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
CCI-000168 Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after… Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention re
CCI-000169 Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defin… Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components.
CCI-000170 Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document t… Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations a
CCI-000171 Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system. Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
CCI-000172 Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3. Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
CCI-000173 Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlat… Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.
CCI-000174 Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is… Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time st
CCI-000175 The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distrib… The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator.
CCI-000176 Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization. Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization.
CCI-000177 The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures… The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for rev
CCI-000178 The organization manages information system authenticators for users and devices by changing default content of authenticators upon informa… The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation.
CCI-000179 The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators. The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators.
CCI-000180 The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators. The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.
CCI-000181 The organization manages information system authenticators by establishing reuse conditions for authenticators. The organization manages information system authenticators by establishing reuse conditions for authenticators.
CCI-000182 Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authentica… Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authenticator type or when organization-defined events occur.
CCI-000183 Manage system authenticators by protecting authenticator content from unauthorized disclosure. Manage system authenticators by protecting authenticator content from unauthorized disclosure.
CCI-000184 Manage system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenti… Manage system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenticators.
CCI-000185 For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor i… For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
CCI-000186 For public key-based authentication, enforce authorized access to the corresponding private key. For public key-based authentication, enforce authorized access to the corresponding private key.
CCI-000187 For public key-based authentication, map the authenticated identity to the account of the individual or group. For public key-based authentication, map the authenticated identity to the account of the individual or group.
CCI-000188 The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person… The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational officia
CCI-000189 The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or o… The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators.
CCI-000190 The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authent… The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery.
CCI-000191 The organization enforces password complexity by the number of special characters used. withdrawn The organization enforces password complexity by the number of special characters used.
CCI-000192 The information system enforces password complexity by the minimum number of upper case characters used. The information system enforces password complexity by the minimum number of upper case characters used.
CCI-000193 The information system enforces password complexity by the minimum number of lower case characters used. The information system enforces password complexity by the minimum number of lower case characters used.
CCI-000194 The information system enforces password complexity by the minimum number of numeric characters used. The information system enforces password complexity by the minimum number of numeric characters used.
CCI-000195 The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined n… The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.
CCI-000196 The information system, for password-based authentication, stores only cryptographically-protected passwords. The information system, for password-based authentication, stores only cryptographically-protected passwords.
CCI-000197 For password-based authentication, transmit passwords only over cryptographically-protected channels. For password-based authentication, transmit passwords only over cryptographically-protected channels.
CCI-000198 The information system enforces minimum password lifetime restrictions. The information system enforces minimum password lifetime restrictions.
CCI-000199 The information system enforces maximum password lifetime restrictions. The information system enforces maximum password lifetime restrictions.
CCI-000200 The information system prohibits password reuse for the organization-defined number of generations. The information system prohibits password reuse for the organization-defined number of generations.
CCI-000201 Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access. Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.
CCI-000202 The organization ensures unencrypted static authenticators are not embedded in access scripts. The organization ensures unencrypted static authenticators are not embedded in access scripts.
CCI-000203 The organization ensures unencrypted static authenticators are not stored on function keys. The organization ensures unencrypted static authenticators are not stored on function keys.
CCI-000204 Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple systems. Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple systems.
CCI-000205 The information system enforces minimum password length. The information system enforces minimum password length.
CCI-000206 Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and… Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
CCI-000207 The organization develops and maintains an inventory of its information systems. The organization develops and maintains an inventory of its information systems.
CCI-000208 The organization determines normal time-of-day and duration usage for information system accounts. The organization determines normal time-of-day and duration usage for information system accounts.
CCI-000209 Develop the results of information security measures of performance. Develop the results of information security measures of performance.
CCI-000210 Monitor the results of information security measures of performance. Monitor the results of information security measures of performance.
CCI-000211 Report on the results of information security measures of performance. Report on the results of information security measures of performance.
CCI-000212 Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organiz… Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
CCI-000213 Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policie… Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
CCI-000214 The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights. The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights.
CCI-000215 The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single us… The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.
CCI-000216 Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan. Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan.
CCI-000217 Defines a time period after which inactive accounts are automatically disabled. Defines a time period after which inactive accounts are automatically disabled.
CCI-000218 The information system, when transferring information between different security domains, identifies information flows by data type specifi… The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.
CCI-000219 When transferring information between different security domains, decompose information into organization-defined policy-relevant subcompon… When transferring information between different security domains, decompose information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.
CCI-000220 The information system, when transferring information between different security domains, implements policy filters that constrain data str… withdrawn The information system, when transferring information between different security domains, implements policy filters that constrain data structure and content to [Assignment: organization-defined information security policy requirements].
CCI-000221 The information system enforces security policies regarding information on interconnected systems. The information system enforces security policies regarding information on interconnected systems.
CCI-000222 The information system uniquely identifies and authenticates source and destination domains for information transfer. withdrawn The information system uniquely identifies and authenticates source and destination domains for information transfer.
CCI-000223 The information system binds security attributes to information to facilitate information flow policy enforcement. The information system binds security attributes to information to facilitate information flow policy enforcement.
CCI-000224 The information system tracks problems associated with the security attribute binding. The information system tracks problems associated with the security attribute binding.
CCI-000225 Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are nec… Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.
CCI-000226 The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to… The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.
CCI-000227 Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the… Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.
CCI-000228 Implement the risk management strategy consistently across the organization. Implement the risk management strategy consistently across the organization.
CCI-000229 The organization documents the security state of organizational information systems and the environments in which those systems operate thr… The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
CCI-000230 The organization tracks the security state of organizational information systems and the environments in which those systems operate throug… The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
CCI-000231 The organization reports the security state of organizational information systems and the environments in which those systems operate throu… The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
CCI-000232 Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication.
CCI-000233 Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process.
CCI-000234 Integrate the authorization processes into an organization-wide risk management program. Integrate the authorization processes into an organization-wide risk management program.
CCI-000235 Define organizational mission and business processes with consideration for information security and the resulting risk to organizational o… Define organizational mission and business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
CCI-000236 Determine information protection needs arising from the defined mission and business processes. Determine information protection needs arising from the defined mission and business processes.
CCI-000237 The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and tem… The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts.
CCI-000238 Defines the frequency to review and update the current assessment, authorization, and monitoring policy. Defines the frequency to review and update the current assessment, authorization, and monitoring policy.
CCI-000239 Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that ad… Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizati
CCI-000240 Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authoriza… Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy.
CCI-000241 Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency. Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency.
CCI-000242 Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated ass… Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.
CCI-000243 Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and mo… Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.
CCI-000244 Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency. Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency.
CCI-000245 The organization develops a security assessment plan for the information system and its environment of operation. The organization develops a security assessment plan for the information system and its environment of operation.
CCI-000246 Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment. Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment.
CCI-000247 Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine contro… Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine control effectiveness.
CCI-000248 Develop a control assessment plan that describes the scope of the assessment including assessment environment. Develop a control assessment plan that describes the scope of the assessment including assessment environment.
CCI-000249 The organizations security assessment plan describes the assessment team. The organizations security assessment plan describes the assessment team.
CCI-000250 The organization's security assessment plan describes assessment roles and responsibilities. The organization's security assessment plan describes assessment roles and responsibilities.
CCI-000251 Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which… Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with
CCI-000252 Defines the frequency on which the security controls in the system and its environment of operation are assessed. Defines the frequency on which the security controls in the system and its environment of operation are assessed.
CCI-000253 Produce a control assessment report that document the results of the assessment. Produce a control assessment report that document the results of the assessment.
CCI-000254 Provide the results of the control assessment to organization-defined individuals or roles. Provide the results of the control assessment to organization-defined individuals or roles.
CCI-000255 Employ independent assessors or assessment teams to conduct control assessments. Employ independent assessors or assessment teams to conduct control assessments.
CCI-000256 Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security i… Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; inside
CCI-000257 The organization authorizes connections from the information system to other information systems through the use of Interconnection Securit… The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements.
CCI-000258 Document, as part of each exchange agreement, the interface characteristics. Document, as part of each exchange agreement, the interface characteristics.
CCI-000259 Document, as part of each exchange agreement, the security requirements, controls and responsibilities for each system, and the impact leve… Document, as part of each exchange agreement, the security requirements, controls and responsibilities for each system, and the impact level of the information communicated.
CCI-000260 The organization documents, for each interconnection, the nature of the information communicated. The organization documents, for each interconnection, the nature of the information communicated.
CCI-000261 The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements. The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.
CCI-000262 The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network w… The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device.
CCI-000263 The organization prohibits the direct connection of a classified, national security system to an external network without the use of organi… The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device.
CCI-000264 Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesse… Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulner
CCI-000265 Defines the frequency with which to update the existing plan of action and milestones for the system. Defines the frequency with which to update the existing plan of action and milestones for the system.
CCI-000266 Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, in… Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
CCI-000267 Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms. Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms.
CCI-000268 Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms. Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms.
CCI-000269 Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms. Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms.
CCI-000270 Assign a senior official as the authorizing official for the system. Assign a senior official as the authorizing official for the system.
CCI-000271 Ensure the authorizing official for the system authorizes the system to operate before commencing operations. Ensure the authorizing official for the system authorizes the system to operate before commencing operations.
CCI-000272 Update the authorization on an organization-defined frequency. Update the authorization on an organization-defined frequency.
CCI-000273 Defines the frequency with which to update the authorizations. Defines the frequency with which to update the authorizations.
CCI-000274 Develop a continuous monitoring strategy. Develop a continuous monitoring strategy.
CCI-000275 The organization implements a continuous monitoring program that includes a configuration management process for the information system. The organization implements a continuous monitoring program that includes a configuration management process for the information system.
CCI-000276 The organization implements a continuous monitoring program that includes a configuration management process for the information system con… The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components.
CCI-000277 The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the informat… The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system.
CCI-000278 The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environm… The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation.
CCI-000279 Implement ongoing control assessments in accordance with the continuous monitoring strategy. Implement ongoing control assessments in accordance with the continuous monitoring strategy.
CCI-000280 Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an orga… Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency.
CCI-000281 Defines the frequency with which to report the security status to organization-defined personnel or roles. Defines the frequency with which to report the security status to organization-defined personnel or roles.
CCI-000282 Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
CCI-000283 The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exe… The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequ
CCI-000284 The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team… The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined f
CCI-000285 The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team… The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined fr
CCI-000286 Defines the frequency with which to review and update the configuration management policies. Defines the frequency with which to review and update the configuration management policies.
CCI-000287 Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addres… Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational
CCI-000288 The organization disseminates formal, documented configuration management policy to elements within the organization having associated conf… The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities.
CCI-000289 Review and update, on an organization-defined frequency, the configuration management policy. Review and update, on an organization-defined frequency, the configuration management policy.
CCI-000290 Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-l… Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and the associated configuration management controls.
CCI-000291 The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and ass… The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
CCI-000292 Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission… Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configura
CCI-000293 The organization develops a current baseline configuration of the information system. The organization develops a current baseline configuration of the information system.
CCI-000294 The organization documents a baseline configuration of the information system. The organization documents a baseline configuration of the information system.
CCI-000295 Maintain, under configuration control, a current baseline configuration of the system. Maintain, under configuration control, a current baseline configuration of the system.
CCI-000296 Review and update the baseline configuration of the system on an organization-defined frequency. Review and update the baseline configuration of the system on an organization-defined frequency.
CCI-000297 Review and update the baseline configuration of the system when required due to organization-defined circumstances. Review and update the baseline configuration of the system when required due to organization-defined circumstances.
CCI-000298 The organization reviews and updates the baseline configuration of the information system as an integral part of information system compone… The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations.
CCI-000299 The organization reviews and updates the baseline configuration of the information system as an integral part of information system compone… The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.
CCI-000300 Maintain complete configuration of the system using organization-defined automated mechanisms. Maintain complete configuration of the system using organization-defined automated mechanisms.
CCI-000301 Maintain current configuration of the system using organization-defined automated mechanisms. Maintain current configuration of the system using organization-defined automated mechanisms.
CCI-000302 Maintain accurate configuration of the system using organization-defined automated mechanisms. Maintain accurate configuration of the system using organization-defined automated mechanisms.
CCI-000303 Maintain available configuration of the system using organization-defined automated mechanisms. Maintain available configuration of the system using organization-defined automated mechanisms.
CCI-000304 Retain organization-defined number of previous versions of baseline configurations of the system to support rollback. Retain organization-defined number of previous versions of baseline configurations of the system to support rollback.
CCI-000305 The organization develops a list of software programs not authorized to execute on the information system. The organization develops a list of software programs not authorized to execute on the information system.
CCI-000306 The organization maintains the list of software programs not authorized to execute on the information system. The organization maintains the list of software programs not authorized to execute on the information system.
CCI-000307 The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information sy… The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.
CCI-000308 The organization develops the list of software programs authorized to execute on the information system. The organization develops the list of software programs authorized to execute on the information system.
CCI-000309 The organization maintains the list of software programs authorized to execute on the information system. The organization maintains the list of software programs authorized to execute on the information system.
CCI-000310 The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information sy… The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.
CCI-000311 Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuratio… Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuration.
CCI-000312 Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration. Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration.
CCI-000313 Determine and document the types of changes to the system that are configuration-controlled. Determine and document the types of changes to the system that are configuration-controlled.
CCI-000314 Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses. Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses.
CCI-000315 The organization documents approved configuration-controlled changes to the system. The organization documents approved configuration-controlled changes to the system.
CCI-000316 Retain records of configuration-controlled changes to the system for an organization-defined time period. Retain records of configuration-controlled changes to the system for an organization-defined time period.
CCI-000317 The organization reviews records of configuration-controlled changes to the system. The organization reviews records of configuration-controlled changes to the system.
CCI-000318 Monitor and review activities associated with configuration-controlled changes to the system. Monitor and review activities associated with configuration-controlled changes to the system.
CCI-000319 Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control… Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control element that convenes at the organization-defined frequency, and/or for any organization-defined conf
CCI-000320 Defines the frequency with which to convene the configuration change control element. Defines the frequency with which to convene the configuration change control element.
CCI-000321 Defines configuration change conditions that prompt the configuration change control element to convene. Defines configuration change conditions that prompt the configuration change control element to convene.
CCI-000322 Use organization-defined automated mechanisms to document proposed changes to the system. Use organization-defined automated mechanisms to document proposed changes to the system.
CCI-000323 Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and req… Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and request change approval.
CCI-000324 Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an… Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an organization-defined time period.
CCI-000325 Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received. Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received.
CCI-000326 Use organization-defined automated mechanisms to document all changes to the system. Use organization-defined automated mechanisms to document all changes to the system.
CCI-000327 Tests changes to the system before finalizing the implementation of the changes. Tests changes to the system before finalizing the implementation of the changes.
CCI-000328 Validate changes to the system before finalizing the implementation of the changes. Validate changes to the system before finalizing the implementation of the changes.
CCI-000329 Document changes to the system before finalizing the implementation of the changes. Document changes to the system before finalizing the implementation of the changes.
CCI-000330 Implement changes to the current system baseline using organization-defined automated mechanisms. Implement changes to the current system baseline using organization-defined automated mechanisms.
CCI-000331 Deploy the updated system baseline across the installed base using organization-defined automated mechanism. Deploy the updated system baseline across the installed base using organization-defined automated mechanism.
CCI-000332 Require an organization-defined security representative to be a member of the organization-defined configuration change control element. Require an organization-defined security representative to be a member of the organization-defined configuration change control element.
CCI-000333 Analyze changes to the system to determine potential security impacts prior to change implementation. Analyze changes to the system to determine potential security impacts prior to change implementation.
CCI-000334 The organization analyzes new software in a separate test environment before installation in an operational environment. The organization analyzes new software in a separate test environment before installation in an operational environment.
CCI-000335 After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system. After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system.
CCI-000336 After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system. After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.
CCI-000337 After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements… After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system.
CCI-000338 The organization defines physical access restrictions associated with changes to the information system. The organization defines physical access restrictions associated with changes to the information system.
CCI-000339 The organization documents physical access restrictions associated with changes to the information system. The organization documents physical access restrictions associated with changes to the information system.
CCI-000340 Approve physical access restrictions associated with changes to the system. Approve physical access restrictions associated with changes to the system.
CCI-000341 Enforce physical access restrictions associated with changes to the system. Enforce physical access restrictions associated with changes to the system.
CCI-000342 The organization defines logical access restrictions associated with changes to the information system. The organization defines logical access restrictions associated with changes to the information system.
CCI-000343 The organization documents logical access restrictions associated with changes to the information system. The organization documents logical access restrictions associated with changes to the information system.
CCI-000344 Approve logical access restrictions associated with changes to the system. Approve logical access restrictions associated with changes to the system.
CCI-000345 Enforce logical access restrictions associated with changes to the system. Enforce logical access restrictions associated with changes to the system.
CCI-000346 The organization employs automated mechanisms to enforce access restrictions. The organization employs automated mechanisms to enforce access restrictions.
CCI-000347 The organization employs automated mechanisms to support auditing of the enforcement actions. The organization employs automated mechanisms to support auditing of the enforcement actions.
CCI-000348 The organization defines a frequency with which to conduct reviews of information system changes. The organization defines a frequency with which to conduct reviews of information system changes.
CCI-000349 The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occur… The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.
CCI-000350 The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have… The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.
CCI-000351 The organization defines critical software programs that the information system will prevent from being installed if such software programs… The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate.
CCI-000352 The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate… The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.
CCI-000353 Defines system components requiring enforcement of a dual authorization for system changes. Defines system components requiring enforcement of a dual authorization for system changes.
CCI-000354 Enforce dual authorization for implementing changes to organization-defined system components. Enforce dual authorization for implementing changes to organization-defined system components.
CCI-000355 The organization limits information system developer/integrator privileges to change hardware components directly within a production envir… The organization limits information system developer/integrator privileges to change hardware components directly within a production environment.
CCI-000356 The organization limits information system developer/integrator privileges to change software components directly within a production envir… The organization limits information system developer/integrator privileges to change software components directly within a production environment.
CCI-000357 The organization limits information system developer/integrator privileges to change firmware components directly within a production envir… The organization limits information system developer/integrator privileges to change firmware components directly within a production environment.
CCI-000358 The organization limits information system developer/integrator privileges to change system information directly within a production enviro… The organization limits information system developer/integrator privileges to change system information directly within a production environment.
CCI-000359 The organization defines the frequency to review information system developer/integrator privileges. The organization defines the frequency to review information system developer/integrator privileges.
CCI-000360 The organization defines the frequency to reevaluate information system developer/integrator privileges. The organization defines the frequency to reevaluate information system developer/integrator privileges.
CCI-000361 The organization reviews information system developer/integrator privileges per organization-defined frequency. The organization reviews information system developer/integrator privileges per organization-defined frequency.
CCI-000362 The organization reevaluates information system developer/integrator privileges per organization-defined frequency. The organization reevaluates information system developer/integrator privileges per organization-defined frequency.
CCI-000363 The organization defines security configuration checklists to be used to establish and document configuration settings for the information… The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.
CCI-000364 The organization establishes configuration settings for information technology products employed within the information system using organi… The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.
CCI-000365 The organization documents configuration settings for information technology products employed within the information system using organiza… The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with
CCI-000366 Implement the security configuration settings. Implement the security configuration settings.
CCI-000367 Identify any deviations from the established configuration settings for organization-defined system components based on organization-define… Identify any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.
CCI-000368 Document any deviations from the established configuration settings for organization-defined system components based on organization-define… Document any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.
CCI-000369 Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined… Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.
CCI-000370 Manage configuration settings for organization-defined system components using organization-defined automated mechanisms. Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-000371 Apply configuration settings for organization-defined system components using organization-defined automated mechanisms. Apply configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-000372 Verify configuration settings for organization-defined system components using organization-defined automated mechanisms. Verify configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-000373 The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms. The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms.
CCI-000374 The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings. The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.
CCI-000375 The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response c… The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability.
CCI-000376 The organization ensures unauthorized, security-relevant configuration changes detected are monitored. The organization ensures unauthorized, security-relevant configuration changes detected are monitored.
CCI-000377 The organization ensures unauthorized, security-relevant configuration changes detected are corrected. The organization ensures unauthorized, security-relevant configuration changes detected are corrected.
CCI-000378 The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes. The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes.
CCI-000379 The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance… The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment.
CCI-000380 Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system. Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system.
CCI-000381 Configure the system to provide only organization-defined mission essential capabilities. Configure the system to provide only organization-defined mission essential capabilities.
CCI-000382 Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, s… Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
CCI-000383 The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/… The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services.
CCI-000384 Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and servi… Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and services.
CCI-000385 The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, an… The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services.
CCI-000386 The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-de… The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.
CCI-000387 Defines registration requirements for functions, ports, protocols, and services. Defines registration requirements for functions, ports, protocols, and services.
CCI-000388 Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services. Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services.
CCI-000389 The organization develops an inventory of information system components that accurately reflects the current information system. The organization develops an inventory of information system components that accurately reflects the current information system.
CCI-000390 The organization documents an inventory of information system components that accurately reflects the current information system. The organization documents an inventory of information system components that accurately reflects the current information system.
CCI-000391 The organization maintains an inventory of information system components that accurately reflects the current information system. The organization maintains an inventory of information system components that accurately reflects the current information system.
CCI-000392 The organization develops an inventory of information system components that includes all components within the authorization boundary of t… The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system.
CCI-000393 The organization documents an inventory of information system components that includes all components within the authorization boundary of… The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system.
CCI-000394 The organization maintains an inventory of information system components that is consistent with the authorization boundary of the informat… The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system.
CCI-000395 The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking a… The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
CCI-000396 The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking… The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
CCI-000397 The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking… The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
CCI-000398 Defines information deemed necessary to achieve effective system component accountability. Defines information deemed necessary to achieve effective system component accountability.
CCI-000399 The organization develops an inventory of information system components that includes organization-defined information deemed necessary to… The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.
CCI-000400 The organization documents an inventory of information system components that includes organization-defined information deemed necessary to… The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.

Showing 400 of 5149; narrow with the search or a family.