NIST SP 800-53 (controls) 5.2.0

1196 requirements · published 2026-10-22
Changes in this version

All AC AT AU CA CM CP IA IR MA MP PE PL PM PS PT RA SA SC SI SR

Controls in this version
Ref	Title	Text
AC-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy that: (a) Addresses purpose
AC-02	Account Management	a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: prerequisites and criteria] for group and role membership; d. Specify: 1. Author
AC-02(01) in AC-2	Automated System Account Management	Support the management of system accounts using [Assignment: automated mechanisms].
AC-02(02) in AC-2	Automated Temporary and Emergency Account Management	Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: time period].
AC-02(03) in AC-2	Disable Accounts	Disable accounts within [Assignment: time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [Assignment: time pe
AC-02(04) in AC-2	Automated Audit Actions	Automatically audit account creation, modification, enabling, disabling, and removal actions.
AC-02(05) in AC-2	Inactivity Logout	Require that users log out when [Assignment: time period of expected inactivity or description of when to log out].
AC-02(06) in AC-2	Dynamic Privilege Management	Implement [Assignment: dynamic privilege management capabilities].
AC-02(07) in AC-2	Privileged User Accounts	(a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles or attrib
AC-02(08) in AC-2	Dynamic Account Management	Create, activate, manage, and deactivate [Assignment: system accounts] dynamically.
AC-02(09) in AC-2	Restrictions on Use of Shared and Group Accounts	Only permit the use of shared and group accounts that meet [Assignment: conditions].
AC-02(10) in AC-2	Shared and Group Account Credential Change withdrawn
AC-02(11) in AC-2	Usage Conditions	Enforce [Assignment: circumstances and/or usage conditions] for [Assignment: system accounts].
AC-02(12) in AC-2	Account Monitoring for Atypical Usage	(a) Monitor system accounts for [Assignment: atypical usage] ; and (b) Report atypical usage of system accounts to [Assignment: personnel or roles].
AC-02(13) in AC-2	Disable Accounts for High-risk Individuals	Disable accounts of individuals within [Assignment: time period] of discovery of [Assignment: significant risks].
AC-03	Access Enforcement	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-03(01) in AC-3	Restricted Access to Privileged Functions withdrawn
AC-03(02) in AC-3	Dual Authorization	Enforce dual authorization for [Assignment: privileged commands and/or other actions].
AC-03(03) in AC-3	Mandatory Access Control	Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within
AC-03(04) in AC-3	Discretionary Access Control	Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information c
AC-03(05) in AC-3	Security-relevant Information	Prevent access to [Assignment: security-relevant information] except during secure, non-operable system states.
AC-03(06) in AC-3	Protection of User and System Information withdrawn
AC-03(07) in AC-3	Role-based Access Control	Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].
AC-03(08) in AC-3	Revocation of Access Authorizations	Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: rules].
AC-03(09) in AC-3	Controlled Release	Release information outside of the system only if: (a) The receiving [Assignment: system or system component] provides [Assignment: controls] ; and (b) [Assignment: controls] are used to validate the appropriateness of the information desig
AC-03(10) in AC-3	Audited Override of Access Control Mechanisms	Employ an audited override of automated access control mechanisms under [Assignment: conditions] by [Assignment: roles].
AC-03(11) in AC-3	Restrict Access to Specific Information Types	Restrict access to data repositories containing [Assignment: information types].
AC-03(12) in AC-3	Assert and Enforce Application Access	(a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: system applications and functions]; (b) Provide an enforcement mechanism to prevent
AC-03(13) in AC-3	Attribute-based Access Control	Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: attributes].
AC-03(14) in AC-3	Individual Access	Provide [Assignment: mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: elements].
AC-03(15) in AC-3	Discretionary and Mandatory Access Control	(a) Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and (b) Enforce [Assignment: organization-defined discretionary access control policy] over
AC-04	Information Flow Enforcement	Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: information flow control policies].
AC-04(01) in AC-4	Object Security and Privacy Attributes	Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: information flow control policies] as a basis for
AC-04(02) in AC-4	Processing Domains	Use protected processing domains to enforce [Assignment: information flow control policies] as a basis for flow control decisions.
AC-04(03) in AC-4	Dynamic Information Flow Control	Enforce [Assignment: information flow control policies].
AC-04(04) in AC-4	Flow Control of Encrypted Information	Prevent encrypted information from bypassing [Assignment: information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions atte
AC-04(05) in AC-4	Embedded Data Types	Enforce [Assignment: limitations] on embedding data types within other data types.
AC-04(06) in AC-4	Metadata	Enforce information flow control based on [Assignment: metadata].
AC-04(07) in AC-4	One-way Flow Mechanisms	Enforce one-way information flows through hardware-based flow control mechanisms.
AC-04(08) in AC-4	Security and Privacy Policy Filters	(a) Enforce information flow control using [Assignment: organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows] ; and (b) [Selection (one or mor
AC-04(09) in AC-4	Human Reviews	Enforce the use of human reviews for [Assignment: information flows] under the following conditions: [Assignment: conditions].
AC-04(10) in AC-4	Enable and Disable Security or Privacy Policy Filters	Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined security or privacy policy filters] under the following conditions: [Assignment: organization-defined conditions].
AC-04(11) in AC-4	Configuration of Security or Privacy Policy Filters	Provide the capability for privileged administrators to configure [Assignment: organization-defined security or privacy policy filters] to support different security or privacy policies.
AC-04(12) in AC-4	Data Type Identifiers	When transferring information between different security domains, use [Assignment: data type identifiers] to validate data essential for information flow decisions.
AC-04(13) in AC-4	Decomposition into Policy-relevant Subcomponents	When transferring information between different security domains, decompose information into [Assignment: policy-relevant subcomponents] for submission to policy enforcement mechanisms.
AC-04(14) in AC-4	Security or Privacy Policy Filter Constraints	When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.
AC-04(15) in AC-4	Detection of Unsanctioned Information	When transferring information between different security domains, examine the information for the presence of [Assignment: unsanctioned information] and prohibit the transfer of such information in accordance with the [Assignment: organizat
AC-04(16) in AC-4	Information Transfers on Interconnected Systems withdrawn
AC-04(17) in AC-4	Domain Authentication	Uniquely identify and authenticate source and destination points by [Selection (one or more): organization, system, application, service, individual] for information transfer.
AC-04(18) in AC-4	Security Attribute Binding withdrawn
AC-04(19) in AC-4	Validation of Metadata	When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] on metadata.
AC-04(20) in AC-4	Approved Solutions	Employ [Assignment: solutions in approved configurations] to control the flow of [Assignment: information] across security domains.
AC-04(21) in AC-4	Physical or Logical Separation of Information Flows	Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: required separations].
AC-04(22) in AC-4	Access Only	Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.
AC-04(23) in AC-4	Modify Non-releasable Information	When transferring information between different security domains, modify non-releasable information by implementing [Assignment: modification action].
AC-04(24) in AC-4	Internal Normalized Format	When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.
AC-04(25) in AC-4	Data Sanitization	When transferring information between different security domains, sanitize data to minimize [Selection (one or more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encod
AC-04(26) in AC-4	Audit Filtering Actions	When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
AC-04(27) in AC-4	Redundant/Independent Filtering Mechanisms	When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
AC-04(28) in AC-4	Linear Filter Pipelines	When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
AC-04(29) in AC-4	Filter Orchestration Engines	When transferring information between different security domains, employ content filter orchestration engines to ensure that: (a) Content filtering mechanisms successfully complete execution without errors; and (b) Content filtering actions
AC-04(30) in AC-4	Filter Mechanisms Using Multiple Processes	When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
AC-04(31) in AC-4	Failed Content Transfer Prevention	When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
AC-04(32) in AC-4	Process Requirements for Information Transfer	When transferring information between different security domains, the process that transfers information between filter pipelines: (a) Does not filter message content; (b) Validates filtering metadata; (c) Ensures the content associated wit
AC-05	Separation of Duties	a. Identify and document [Assignment: duties of individuals] ; and b. Define system access authorizations to support separation of duties.
AC-06	Least Privilege	Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
AC-06(01) in AC-6	Authorize Access to Security Functions	Authorize access for [Assignment: individuals and roles] to: (a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)] ; and (b) [Assignment: security-relevant information].
AC-06(02) in AC-6	Non-privileged Access for Nonsecurity Functions	Require that users of system accounts (or roles) with access to [Assignment: security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-06(03) in AC-6	Network Access to Privileged Commands	Authorize network access to [Assignment: privileged commands] only for [Assignment: compelling operational needs] and document the rationale for such access in the security plan for the system.
AC-06(04) in AC-6	Separate Processing Domains	Provide separate processing domains to enable finer-grained allocation of user privileges.
AC-06(05) in AC-6	Privileged Accounts	Restrict privileged accounts on the system to [Assignment: personnel or roles].
AC-06(06) in AC-6	Privileged Access by Non-organizational Users	Prohibit privileged access to the system by non-organizational users.
AC-06(07) in AC-6	Review of User Privileges	(a) Review [Assignment: frequency] the privileges assigned to [Assignment: roles and classes] to validate the need for such privileges; and (b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and bus
AC-06(08) in AC-6	Privilege Levels for Code Execution	Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: software].
AC-06(09) in AC-6	Log Use of Privileged Functions	Log the execution of privileged functions.
AC-06(10) in AC-6	Prohibit Non-privileged Users from Executing Privileged Functions	Prevent non-privileged users from executing privileged functions.
AC-07	Unsuccessful Logon Attempts	a. Enforce a limit of [Assignment: number] consecutive invalid logon attempts by a user during a [Assignment: time period] ; and b. Automatically [Selection (one or more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; loc
AC-07(01) in AC-7	Automatic Account Lock withdrawn
AC-07(02) in AC-7	Purge or Wipe Mobile Device	Purge or wipe information from [Assignment: mobile devices] based on [Assignment: purging or wiping requirements and techniques] after [Assignment: number] consecutive, unsuccessful device logon attempts.
AC-07(03) in AC-7	Biometric Attempt Limiting	Limit the number of unsuccessful biometric logon attempts to [Assignment: number].
AC-07(04) in AC-7	Use of Alternate Authentication Factor	(a) Allow the use of [Assignment: authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and (b) Enforce a limit of
AC-08	System Use Notification	a. Display [Assignment: system use notification] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and g
AC-09	Previous Logon Notification	Notify the user, upon successful logon to the system, of the date and time of the last logon.
AC-09(01) in AC-9	Unsuccessful Logons	Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.
AC-09(02) in AC-9	Successful and Unsuccessful Logons	Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: time period].
AC-09(03) in AC-9	Notification of Account Changes	Notify the user, upon successful logon, of changes to [Assignment: security-related characteristics or parameters] during [Assignment: time period].
AC-09(04) in AC-9	Additional Logon Information	Notify the user, upon successful logon, of the following additional information: [Assignment: additional information].
AC-10	Concurrent Session Control	Limit the number of concurrent sessions for each [Assignment: account and/or account types] to [Assignment: number].
AC-11	Device Lock	a. Prevent further access to the system by [Selection (one or more): initiating a device lock after {{ insert: param, ac-11_odp.02 }} of inactivity; requiring the user to initiate a device lock before leaving the system unattended] ; and b.
AC-11(01) in AC-11	Pattern-hiding Displays	Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
AC-12	Session Termination	Automatically terminate a user session after [Assignment: conditions or trigger events].
AC-12(01) in AC-12	User-initiated Logouts	Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: information resources].
AC-12(02) in AC-12	Termination Message	Display an explicit logout message to users indicating the termination of authenticated communications sessions.
AC-12(03) in AC-12	Timeout Warning Message	Display an explicit message to users indicating that the session will end in [Assignment: time].
AC-13	Supervision and Review — Access Control withdrawn
AC-14	Permitted Actions Without Identification or Authentication	a. Identify [Assignment: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and b. Document and provide supporting rationale in the secur
AC-14(01) in AC-14	Necessary Uses withdrawn
AC-15	Automated Marking withdrawn
AC-16	Security and Privacy Attributes	a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in tr
AC-16(01) in AC-16	Dynamic Attribute Association	Dynamically associate security and privacy attributes with [Assignment: organization-defined subjects and objects] in accordance with the following security and privacy policies as information is created and combined: [Assignment: organizat
AC-16(02) in AC-16	Attribute Value Changes by Authorized Individuals	Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.
AC-16(03) in AC-16	Maintenance of Attribute Associations by System	Maintain the association and integrity of [Assignment: organization-defined security and privacy attributes] to [Assignment: organization-defined subjects and objects].
AC-16(04) in AC-16	Association of Attributes by Authorized Individuals	Provide the capability to associate [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] by authorized individuals (or processes acting on behalf of individuals).
AC-16(05) in AC-16	Attribute Displays on Objects to Be Output	Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: instructions] using [Assignment: naming conventions].
AC-16(06) in AC-16	Maintenance of Attribute Association	Require personnel to associate and maintain the association of [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defi
AC-16(07) in AC-16	Consistent Attribute Interpretation	Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.
AC-16(08) in AC-16	Association Techniques and Technologies	Implement [Assignment: organization-defined techniques and technologies] in associating security and privacy attributes to information.
AC-16(09) in AC-16	Attribute Reassignment — Regrading Mechanisms	Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures].
AC-16(10) in AC-16	Attribute Configuration by Authorized Individuals	Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.
AC-17	Remote Access	a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connec
AC-17(01) in AC-17	Monitoring and Control	Employ automated mechanisms to monitor and control remote access methods.
AC-17(02) in AC-17	Protection of Confidentiality and Integrity Using Encryption	Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
AC-17(03) in AC-17	Managed Access Control Points	Route remote accesses through authorized and managed network access control points.
AC-17(04) in AC-17	Privileged Commands and Access	(a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs] ; and
AC-17(05) in AC-17	Monitoring for Unauthorized Connections withdrawn
AC-17(06) in AC-17	Protection of Mechanism Information	Protect information about remote access mechanisms from unauthorized use and disclosure.
AC-17(07) in AC-17	Additional Protection for Security Function Access withdrawn
AC-17(08) in AC-17	Disable Nonsecure Network Protocols withdrawn
AC-17(09) in AC-17	Disconnect or Disable Access	Provide the capability to disconnect or disable remote access to the system within [Assignment: time period].
AC-17(10) in AC-17	Authenticate Remote Commands	Implement [Assignment: mechanisms] to authenticate [Assignment: remote commands].
AC-18	Wireless Access	a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior to allowing such connections.
AC-18(01) in AC-18	Authentication and Encryption	Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
AC-18(02) in AC-18	Monitoring Unauthorized Connections withdrawn
AC-18(03) in AC-18	Disable Wireless Networking	Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
AC-18(04) in AC-18	Restrict Configurations by Users	Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
AC-18(05) in AC-18	Antennas and Transmission Power Levels	Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
AC-19	Access Control for Mobile Devices	a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b. Authorize the connection of mobil
AC-19(01) in AC-19	Use of Writable and Portable Storage Devices withdrawn
AC-19(02) in AC-19	Use of Personally Owned Portable Storage Devices withdrawn
AC-19(03) in AC-19	Use of Portable Storage Devices with No Identifiable Owner withdrawn
AC-19(04) in AC-19	Restrictions for Classified Information	(a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and (b) Enforce the following restri
AC-19(05) in AC-19	Full Device or Container-based Encryption	Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: mobile devices].
AC-20	Use of External Systems	a. [Selection (one or more): establish {{ insert: param, ac-20_odp.02 }} ; identify {{ insert: param, ac-20_odp.03 }} ] , consistent with the trust relationships established with other organizations owning, operating, and/or maintaining ext
AC-20(01) in AC-20	Limits on Authorized Use	Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementation of controls on the external system as spec
AC-20(02) in AC-20	Portable Storage Devices — Restricted Use	Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: restrictions].
AC-20(03) in AC-20	Non-organizationally Owned Systems — Restricted Use	Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: restrictions].
AC-20(04) in AC-20	Network Accessible Storage Devices — Prohibited Use	Prohibit the use of [Assignment: network-accessible storage devices] in external systems.
AC-20(05) in AC-20	Portable Storage Devices — Prohibited Use	Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
AC-21	Information Sharing	a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: information-sharing circumstances] ; and b. Employ [Assignment: automat
AC-21(01) in AC-21	Automated Decision Support	Employ [Assignment: automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
AC-21(02) in AC-21	Information Search and Retrieval	Implement information search and retrieval services that enforce [Assignment: information-sharing restrictions].
AC-22	Publicly Accessible Content	a. Designate individuals authorized to make information publicly accessible; b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c. Review the proposed content of informatio
AC-23	Data Mining Protection	Employ [Assignment: techniques] for [Assignment: data storage objects] to detect and protect against unauthorized data mining.
AC-24	Access Control Decisions	[Selection (one or more): establish procedures; implement mechanisms] to ensure [Assignment: access control decisions] are applied to each access request prior to access enforcement.
AC-24(01) in AC-24	Transmit Access Authorization Information	Transmit [Assignment: access authorization information] using [Assignment: controls] to [Assignment: systems] that enforce access control decisions.
AC-24(02) in AC-24	No User or Process Identity	Enforce access control decisions based on [Assignment: organization-defined security or privacy attributes] that do not include the identity of the user or process acting on behalf of the user.
AC-25	Reference Monitor	Implement a reference monitor for [Assignment: access control policies] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
AT-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy that: (a) Addresses
AT-02	Literacy Training and Awareness	a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and 2. Whe
AT-02(01) in AT-2	Practical Exercises	Provide practical exercises in literacy training that simulate events and incidents.
AT-02(02) in AT-2	Insider Threat	Provide literacy training on recognizing and reporting potential indicators of insider threat.
AT-02(03) in AT-2	Social Engineering and Mining	Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
AT-02(04) in AT-2	Suspicious Communications and Anomalous System Behavior	Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: indicators of malicious code].
AT-02(05) in AT-2	Advanced Persistent Threat	Provide literacy training on the advanced persistent threat.
AT-02(06) in AT-2	Cyber Threat Environment	(a) Provide literacy training on the cyber threat environment; and (b) Reflect current cyber threat information in system operations.
AT-03	Role-based Training	a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: 1. Before authorizing access to the system, information, or perfo
AT-03(01) in AT-3	Environmental Controls	Provide [Assignment: personnel or roles] with initial and [Assignment: frequency] training in the employment and operation of environmental controls.
AT-03(02) in AT-3	Physical Security Controls	Provide [Assignment: personnel or roles] with initial and [Assignment: frequency] training in the employment and operation of physical security controls.
AT-03(03) in AT-3	Practical Exercises	Provide practical exercises in security and privacy training that reinforce training objectives.
AT-03(04) in AT-3	Suspicious Communications and Anomalous System Behavior withdrawn
AT-03(05) in AT-3	Processing Personally Identifiable Information	Provide [Assignment: personnel or roles] with initial and [Assignment: frequency] training in the employment and operation of personally identifiable information processing and transparency controls.
AT-04	Training Records	a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b. Retain individual training records for [Assignment
AT-05	Contacts with Security Groups and Associations withdrawn
AT-06	Training Feedback	Provide feedback on organizational training results to the following personnel [Assignment: frequency]: [Assignment: personnel].
AU-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] audit and accountability policy that: (a) Address
AU-02	Event Logging	a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: event types]; b. Coordinate the event logging function with other organizational entities requiring audit-related informati
AU-02(01) in AU-2	Compilation of Audit Records from Multiple Sources withdrawn
AU-02(02) in AU-2	Selection of Audit Events by Component withdrawn
AU-02(03) in AU-2	Reviews and Updates withdrawn
AU-02(04) in AU-2	Privileged Functions withdrawn
AU-03	Content of Audit Records	Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcome of the event; and f. Identity of any i
AU-03(01) in AU-3	Additional Audit Information	Generate audit records containing the following additional information: [Assignment: additional information].
AU-03(02) in AU-3	Centralized Management of Planned Audit Record Content withdrawn
AU-03(03) in AU-3	Limit Personally Identifiable Information Elements	Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: elements].
AU-04	Audit Log Storage Capacity	Allocate audit log storage capacity to accommodate [Assignment: audit log retention requirements].
AU-04(01) in AU-4	Transfer to Alternate Storage	Transfer audit logs [Assignment: frequency] to a different system, system component, or media other than the system or system component conducting the logging.
AU-05	Response to Audit Logging Process Failures	a. Alert [Assignment: personnel or roles] within [Assignment: time period] in the event of an audit logging process failure; and b. Take the following additional actions: [Assignment: additional actions].
AU-05(01) in AU-5	Storage Capacity Warning	Provide a warning to [Assignment: personnel, roles, and/or locations] within [Assignment: time period] when allocated audit log storage volume reaches [Assignment: percentage] of repository maximum audit log storage capacity.
AU-05(02) in AU-5	Real-time Alerts	Provide an alert within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: audit logging failure events requiring real-time alerts].
AU-05(03) in AU-5	Configurable Traffic Volume Thresholds	Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection (one or more): reject; delay] network traffic above those thresholds.
AU-05(04) in AU-5	Shutdown on Failure	Invoke a [Selection (one or more): full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: audit logging failures] , unless an alternate
AU-05(05) in AU-5	Alternate Audit Logging Capability	Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: alternate audit logging functionality].
AU-06	Audit Record Review, Analysis, and Reporting	a. Review and analyze system audit records [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; b. Report findings to [Assignment: pers
AU-06(01) in AU-6	Automated Process Integration	Integrate audit record review, analysis, and reporting processes using [Assignment: automated mechanisms].
AU-06(02) in AU-6	Automated Security Alerts withdrawn
AU-06(03) in AU-6	Correlate Audit Record Repositories	Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
AU-06(04) in AU-6	Central Review and Analysis	Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
AU-06(05) in AU-6	Integrated Analysis of Audit Records	Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; {{ insert: param, au-06.05_odp.02 }} ] to further enhance the ability to ide
AU-06(06) in AU-6	Correlation with Physical Monitoring	Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
AU-06(07) in AU-6	Permitted Actions	Specify the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information.
AU-06(08) in AU-6	Full Text Analysis of Privileged Commands	Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.
AU-06(09) in AU-6	Correlation with Information from Nontechnical Sources	Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
AU-06(10) in AU-6	Audit Level Adjustment withdrawn
AU-07	Audit Record Reduction and Report Generation	Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the
AU-07(01) in AU-7	Automatic Processing	Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: fields within audit records].
AU-07(02) in AU-7	Automatic Sort and Search withdrawn
AU-08	Time Stamps	a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time of
AU-08(01) in AU-8	Synchronization with Authoritative Time Source withdrawn
AU-08(02) in AU-8	Secondary Authoritative Time Source withdrawn
AU-09	Protection of Audit Information	a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [Assignment: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.
AU-09(01) in AU-9	Hardware Write-once Media	Write audit trails to hardware-enforced, write-once media.
AU-09(02) in AU-9	Store on Separate Physical Systems or Components	Store audit records [Assignment: frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
AU-09(03) in AU-9	Cryptographic Protection	Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
AU-09(04) in AU-9	Access by Subset of Privileged Users	Authorize access to management of audit logging functionality to only [Assignment: subset of privileged users or roles].
AU-09(05) in AU-9	Dual Authorization	Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: audit information].
AU-09(06) in AU-9	Read-only Access	Authorize read-only access to audit information to [Assignment: subset of privileged users or roles].
AU-09(07) in AU-9	Store on Component with Different Operating System	Store audit information on a component running a different operating system than the system or component being audited.
AU-10	Non-repudiation	Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: actions].
AU-10(01) in AU-10	Association of Identities	(a) Bind the identity of the information producer with the information to [Assignment: strength of binding] ; and (b) Provide the means for authorized individuals to determine the identity of the producer of the information.
AU-10(02) in AU-10	Validate Binding of Information Producer Identity	(a) Validate the binding of the information producer identity to the information at [Assignment: frequency] ; and (b) Perform [Assignment: actions] in the event of a validation error.
AU-10(03) in AU-10	Chain of Custody	Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.
AU-10(04) in AU-10	Validate Binding of Information Reviewer Identity	(a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: security domains] ; and (b) Perform [Assignment: actions] in the event of a
AU-10(05) in AU-10	Digital Signatures withdrawn
AU-11	Audit Record Retention	Retain audit records for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
AU-11(01) in AU-11	Long-term Retrieval Capability	Employ [Assignment: measures] to ensure that long-term audit records generated by the system can be retrieved.
AU-12	Audit Record Generation	a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: system components]; b. Allow [Assignment: personnel or roles] to select the event types t
AU-12(01) in AU-12	System-wide and Time-correlated Audit Trail	Compile audit records from [Assignment: system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: level of tolerance].
AU-12(02) in AU-12	Standardized Formats	Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
AU-12(03) in AU-12	Changes by Authorized Individuals	Provide and implement the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds].
AU-12(04) in AU-12	Query Parameter Audits of Personally Identifiable Information	Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
AU-13	Monitoring for Information Disclosure	a. Monitor [Assignment: open-source information and/or information sites] [Assignment: frequency] for evidence of unauthorized disclosure of organizational information; and b. If an information disclosure is discovered: 1. Notify [Assignmen
AU-13(01) in AU-13	Use of Automated Tools	Monitor open-source information and information sites using [Assignment: automated mechanisms].
AU-13(02) in AU-13	Review of Monitored Sites	Review the list of open-source information sites being monitored [Assignment: frequency].
AU-13(03) in AU-13	Unauthorized Replication of Information	Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.
AU-14	Session Audit	a. Provide and implement the capability for [Assignment: users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: circumstances] ; and b. Develop, integrate, and use session audi
AU-14(01) in AU-14	System Start-up	Initiate session audits automatically at system start-up.
AU-14(02) in AU-14	Capture and Record Content withdrawn
AU-14(03) in AU-14	Remote Viewing and Listening	Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
AU-15	Alternate Audit Logging Capability withdrawn
AU-16	Cross-organizational Audit Logging	Employ [Assignment: methods] for coordinating [Assignment: audit information] among external organizations when audit information is transmitted across organizational boundaries.
AU-16(01) in AU-16	Identity Preservation	Preserve the identity of individuals in cross-organizational audit trails.
AU-16(02) in AU-16	Sharing of Audit Information	Provide cross-organizational audit information to [Assignment: organizations] based on [Assignment: cross-organizational sharing agreements].
AU-16(03) in AU-16	Disassociability	Implement [Assignment: measures] to disassociate individuals from audit information transmitted across organizational boundaries.
CA-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy
CA-02	Control Assessments	a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Controls and control enhancements under assessme
CA-02(01) in CA-2	Independent Assessors	Employ independent assessors or assessment teams to conduct control assessments.
CA-02(02) in CA-2	Specialized Assessments	Include as part of control assessments, [Assignment: specialized assessment frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerabili
CA-02(03) in CA-2	Leveraging Results from External Organizations	Leverage the results of control assessments performed by [Assignment: external organization(s)] on [Assignment: system] when the assessment meets [Assignment: requirements].
CA-03	Information Exchange	a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; s
CA-03(01) in CA-3	Unclassified National Security System Connections withdrawn
CA-03(02) in CA-3	Classified National Security System Connections withdrawn
CA-03(03) in CA-3	Unclassified Non-national Security System Connections withdrawn
CA-03(04) in CA-3	Connections to Public Networks withdrawn
CA-03(05) in CA-3	Restrictions on External System Connections withdrawn
CA-03(06) in CA-3	Transfer Authorizations	Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
CA-03(07) in CA-3	Transitive Information Exchanges	(a) Identify transitive (downstream) information exchanges with other systems through the systems identified in [CA-3a](#ca-3_smt.a) ; and (b) Take measures to ensure that transitive (downstream) information exchanges cease when the control
CA-04	Security Certification withdrawn
CA-05	Plan of Action and Milestones	a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vul
CA-05(01) in CA-5	Automation Support for Accuracy and Currency	Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: automated mechanisms].
CA-06	Authorization	a. Assign a senior official as the authorizing official for the system; b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c. Ensure that the authorizing official
CA-06(01) in CA-6	Joint Authorization — Intra-organization	Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.
CA-06(02) in CA-6	Joint Authorization — Inter-organization	Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.
CA-07	Continuous Monitoring	Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monit
CA-07(01) in CA-7	Independent Assessment	Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
CA-07(02) in CA-7	Types of Assessments withdrawn
CA-07(03) in CA-7	Trend Analyses	Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.
CA-07(04) in CA-7	Risk Monitoring	Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring.
CA-07(05) in CA-7	Consistency Analysis	Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignment: organization-defined actions].
CA-07(06) in CA-7	Automation Support for Monitoring	Ensure the accuracy, currency, and availability of monitoring results for the system using [Assignment: automated mechanisms].
CA-08	Penetration Testing	Conduct penetration testing [Assignment: frequency] on [Assignment: system(s) or system components].
CA-08(01) in CA-8	Independent Penetration Testing Agent or Team	Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.
CA-08(02) in CA-8	Red Team Exercises	Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: red team exercises].
CA-08(03) in CA-8	Facility Penetration Testing	Employ a penetration testing process that includes [Assignment: frequency] [Selection (one or more): announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.
CA-09	Internal System Connections	a. Authorize internal connections of [Assignment: system components] to the system; b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
CA-09(01) in CA-9	Compliance Checks	Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.
CM-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] configuration management policy that: (a) Address
CM-02	Baseline Configuration	a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: frequency]; 2. When required due to [Assignme
CM-02(01) in CM-2	Reviews and Updates withdrawn
CM-02(02) in CM-2	Automation Support for Accuracy and Currency	Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: automated mechanisms].
CM-02(03) in CM-2	Retention of Previous Configurations	Retain [Assignment: number] of previous versions of baseline configurations of the system to support rollback.
CM-02(04) in CM-2	Unauthorized Software withdrawn
CM-02(05) in CM-2	Authorized Software withdrawn
CM-02(06) in CM-2	Development and Test Environments	Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.
CM-02(07) in CM-2	Configure Systems and Components for High-risk Areas	(a) Issue [Assignment: systems or system components] with [Assignment: configurations] to individuals traveling to locations that the organization deems to be of significant risk; and (b) Apply the following controls to the systems or compo
CM-03	Configuration Change Control	a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for securit
CM-03(01) in CM-3	Automated Documentation, Notification, and Prohibition of Changes	Use [Assignment: automated mechanisms] to: (a) Document proposed changes to the system; (b) Notify [Assignment: approval authorities] of proposed changes to the system and request change approval; (c) Highlight proposed changes to the syste
CM-03(02) in CM-3	Testing, Validation, and Documentation of Changes	Test, validate, and document changes to the system before finalizing the implementation of the changes.
CM-03(03) in CM-3	Automated Change Implementation	Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: automated mechanisms].
CM-03(04) in CM-3	Security and Privacy Representatives	Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: configuration change control element].
CM-03(05) in CM-3	Automated Security Response	Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: security responses].
CM-03(06) in CM-3	Cryptography Management	Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: controls].
CM-03(07) in CM-3	Review System Changes	Review changes to the system [Assignment: frequency] or when [Assignment: circumstances] to determine whether unauthorized changes have occurred.
CM-03(08) in CM-3	Prevent or Restrict Configuration Changes	Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: circumstances].
CM-04	Impact Analyses	Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
CM-04(01) in CM-4	Separate Test Environments	Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CM-04(02) in CM-4	Verification of Controls	After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.
CM-05	Access Restrictions for Change	Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
CM-05(01) in CM-5	Automated Access Enforcement and Audit Records	(a) Enforce access restrictions using [Assignment: automated mechanisms] ; and (b) Automatically generate audit records of the enforcement actions.
CM-05(02) in CM-5	Review System Changes withdrawn
CM-05(03) in CM-5	Signed Components withdrawn
CM-05(04) in CM-5	Dual Authorization	Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].
CM-05(05) in CM-5	Privilege Limitation for Production and Operation	(a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment: organization-defined frequency].
CM-05(06) in CM-5	Limit Library Privileges	Limit privileges to change software resident within software libraries.
CM-05(07) in CM-5	Automatic Implementation of Security Safeguards withdrawn
CM-06	Configuration Settings	a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: common secure configurations]; b. Implement the co
CM-06(01) in CM-6	Automated Management, Application, and Verification	Manage, apply, and verify configuration settings for [Assignment: system components] using [Assignment: organization-defined automated mechanisms].
CM-06(02) in CM-6	Respond to Unauthorized Changes	Take the following actions in response to unauthorized changes to [Assignment: configuration settings]: [Assignment: actions].
CM-06(03) in CM-6	Unauthorized Change Detection withdrawn
CM-06(04) in CM-6	Conformance Demonstration withdrawn
CM-07	Least Functionality	a. Configure the system to provide only [Assignment: mission-essential capabilities] ; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited
CM-07(01) in CM-7	Periodic Review	(a) Review the system [Assignment: frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [Assignment: organization-defined functions, ports, protocols, software, a
CM-07(02) in CM-7	Prevent Program Execution	Prevent program execution in accordance with [Selection (one or more): {{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage].
CM-07(03) in CM-7	Registration Compliance	Ensure compliance with [Assignment: registration requirements].
CM-07(04) in CM-7	Unauthorized Software — Deny-by-exception	(a) Identify [Assignment: software programs]; (b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and (c) Review and update the list of unauthorized software programs
CM-07(05) in CM-7	Authorized Software — Allow-by-exception	(a) Identify [Assignment: software programs]; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and (c) Review and update the list of authorized software programs [Assign
CM-07(06) in CM-7	Confined Environments with Limited Privileges	Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: user-installed software].
CM-07(07) in CM-7	Code Execution in Protected Environments	Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: personnel or roles] when such code is: (a) Obtained from sources with limited or n
CM-07(08) in CM-7	Binary or Machine Executable Code	(a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and (b) Allow exceptions only for compelling mission or operational requirements and with the approv
CM-07(09) in CM-7	Prohibiting The Use of Unauthorized Hardware	(a) Identify [Assignment: hardware components]; (b) Prohibit the use or connection of unauthorized hardware components; (c) Review and update the list of authorized hardware components [Assignment: frequency].
CM-08	System Component Inventory	a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other syst
CM-08(01) in CM-8	Updates During Installation and Removal	Update the inventory of system components as part of component installations, removals, and system updates.
CM-08(02) in CM-8	Automated Maintenance	Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].
CM-08(03) in CM-8	Automated Unauthorized Component Detection	(a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: frequency] ; and (b) Take the following actions when unauthoriz
CM-08(04) in CM-8	Accountability Information	Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role] , individuals responsible and accountable for administering those components.
CM-08(05) in CM-8	No Duplicate Accounting of Components withdrawn
CM-08(06) in CM-8	Assessed Configurations and Approved Deviations	Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.
CM-08(07) in CM-8	Centralized Repository	Provide a centralized repository for the inventory of system components.
CM-08(08) in CM-8	Automated Location Tracking	Support the tracking of system components by geographic location using [Assignment: automated mechanisms].
CM-08(09) in CM-8	Assignment of Components to Systems	(a) Assign system components to a system; and (b) Receive an acknowledgement from [Assignment: personnel or roles] of this assignment.
CM-09	Configuration Management Plan	Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a process for identifying configuration items
CM-09(01) in CM-9	Assignment of Responsibility	Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
CM-10	Software Usage Restrictions	a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and c. Con
CM-10(01) in CM-10	Open-source Software	Establish the following restrictions on the use of open-source software: [Assignment: restrictions].
CM-11	User-installed Software	a. Establish [Assignment: policies] governing the installation of software by users; b. Enforce software installation policies through the following methods: [Assignment: methods] ; and c. Monitor policy compliance [Assignment: frequency].
CM-11(01) in CM-11	Alerts for Unauthorized Installations withdrawn
CM-11(02) in CM-11	Software Installation with Privileged Status	Allow user installation of software only with explicit privileged status.
CM-11(03) in CM-11	Automated Enforcement and Monitoring	Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms].
CM-12	Information Location	a. Identify and document the location of [Assignment: information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access to the system and system components w
CM-12(01) in CM-12	Automated Tools to Support Information Location	Use automated tools to identify [Assignment: information by information type] on [Assignment: system components] to ensure controls are in place to protect organizational information and individual privacy.
CM-13	Data Action Mapping	Develop and document a map of system data actions.
CM-14	Signed Components	Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
CP-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy that: (a) Addresses p
CP-02	Contingency Plan	a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingenc
CP-02(01) in CP-2	Coordinate with Related Plans	Coordinate contingency plan development with organizational elements responsible for related plans.
CP-02(02) in CP-2	Capacity Planning	Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
CP-02(03) in CP-2	Resume Mission and Business Functions	Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: time period] of contingency plan activation.
CP-02(04) in CP-2	Resume All Mission and Business Functions withdrawn
CP-02(05) in CP-2	Continue Mission and Business Functions	Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites.
CP-02(06) in CP-2	Alternate Processing and Storage Sites	Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to pri
CP-02(07) in CP-2	Coordinate with External Service Providers	Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
CP-02(08) in CP-2	Identify Critical Assets	Identify critical system assets supporting [Selection: all; essential] mission and business functions.
CP-03	Contingency Training	a. Provide contingency training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: time period] of assuming a contingency role or responsibility; 2. When required by system changes; and 3. [Assignmen
CP-03(01) in CP-3	Simulated Events	Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.
CP-03(02) in CP-3	Mechanisms Used in Training Environments	Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.
CP-04	Contingency Plan Testing	a. Test the contingency plan for the system [Assignment: frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined tests]. b. Review the continge
CP-04(01) in CP-4	Coordinate with Related Plans	Coordinate contingency plan testing with organizational elements responsible for related plans.
CP-04(02) in CP-4	Alternate Processing Site	Test the contingency plan at the alternate processing site: (a) To familiarize contingency personnel with the facility and available resources; and (b) To evaluate the capabilities of the alternate processing site to support contingency ope
CP-04(03) in CP-4	Automated Testing	Test the contingency plan using [Assignment: automated mechanisms].
CP-04(04) in CP-4	Full Recovery and Reconstitution	Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.
CP-04(05) in CP-4	Self-challenge	Employ [Assignment: mechanisms] to [Assignment: system or system component] to disrupt and adversely affect the system or system component.
CP-05	Contingency Plan Update withdrawn
CP-06	Alternate Storage Site	a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls equivalent to that of the primary site.
CP-06(01) in CP-6	Separation from Primary Site	Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.
CP-06(02) in CP-6	Recovery Time and Recovery Point Objectives	Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
CP-06(03) in CP-6	Accessibility	Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.
CP-07	Alternate Processing Site	a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: system operations] for essential mission and business functions within [Assignment: time period] when the primar
CP-07(01) in CP-7	Separation from Primary Site	Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.
CP-07(02) in CP-7	Accessibility	Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
CP-07(03) in CP-7	Priority of Service	Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
CP-07(04) in CP-7	Preparation for Use	Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions.
CP-07(05) in CP-7	Equivalent Information Security Safeguards withdrawn
CP-07(06) in CP-7	Inability to Return to Primary Site	Plan and prepare for circumstances that preclude returning to the primary processing site.
CP-08	Telecommunications Services	Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: system operations] for essential mission and business functions within [Assignment: time period] when the primary telec
CP-08(01) in CP-8	Priority of Service Provisions	(a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Servic
CP-08(02) in CP-8	Single Points of Failure	Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
CP-08(03) in CP-8	Separation of Primary and Alternate Providers	Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
CP-08(04) in CP-8	Provider Contingency Plan	(a) Require primary and alternate telecommunications service providers to have contingency plans; (b) Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and (c) Obtain evidence of contin
CP-08(05) in CP-8	Alternate Telecommunication Service Testing	Test alternate telecommunication services [Assignment: frequency].
CP-09	System Backup	a. Conduct backups of user-level information contained in [Assignment: system components] [Assignment: frequency]; b. Conduct backups of system-level information contained in the system [Assignment: frequency]; c. Conduct backups of system
CP-09(01) in CP-9	Testing for Reliability and Integrity	Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.
CP-09(02) in CP-9	Test Restoration Using Sampling	Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.
CP-09(03) in CP-9	Separate Storage for Critical Information	Store backup copies of [Assignment: critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated with the operational system.
CP-09(04) in CP-9	Protection from Unauthorized Modification withdrawn
CP-09(05) in CP-9	Transfer to Alternate Storage Site	Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives].
CP-09(06) in CP-9	Redundant Secondary System	Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.
CP-09(07) in CP-9	Dual Authorization for Deletion or Destruction	Enforce dual authorization for the deletion or destruction of [Assignment: backup information].
CP-09(08) in CP-9	Cryptographic Protection	Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: backup information].
CP-10	System Recovery and Reconstitution	Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure.
CP-10(01) in CP-10	Contingency Plan Testing withdrawn
CP-10(02) in CP-10	Transaction Recovery	Implement transaction recovery for systems that are transaction-based.
CP-10(03) in CP-10	Compensating Security Controls withdrawn	Addressed through tailoring.
CP-10(04) in CP-10	Restore Within Time Period	Provide the capability to restore system components within [Assignment: restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components.
CP-10(05) in CP-10	Failover Capability withdrawn
CP-10(06) in CP-10	Component Protection	Protect system components used for recovery and reconstitution.
CP-11	Alternate Communications Protocols	Provide the capability to employ [Assignment: alternative communications protocols] in support of maintaining continuity of operations.
CP-12	Safe Mode	When [Assignment: conditions] are detected, enter a safe mode of operation with [Assignment: restrictions].
CP-13	Alternative Security Mechanisms	Employ [Assignment: alternative or supplemental security mechanisms] for satisfying [Assignment: security functions] when the primary means of implementing the security function is unavailable or compromised.
IA-01	Policy and Procedures	a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy that: (a
IA-02	Identification and Authentication (Organizational Users)	Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
IA-02(01) in IA-2	Multi-factor Authentication to Privileged Accounts	Implement multi-factor authentication for access to privileged accounts.
IA-02(02) in IA-2	Multi-factor Authentication to Non-privileged Accounts	Implement multi-factor authentication for access to non-privileged accounts.
IA-02(03) in IA-2	Local Access to Privileged Accounts withdrawn
IA-02(04) in IA-2	Local Access to Non-privileged Accounts withdrawn
IA-02(05) in IA-2	Individual Authentication with Group Authentication	When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.
IA-02(06) in IA-2	Access to Accounts —separate Device	Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate
IA-02(07) in IA-2	Network Access to Non-privileged Accounts — Separate Device withdrawn
IA-02(08) in IA-2	Access to Accounts — Replay Resistant	Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].
IA-02(09) in IA-2	Network Access to Non-privileged Accounts — Replay Resistant withdrawn
IA-02(10) in IA-2	Single Sign-on	Provide a single sign-on capability for [Assignment: system accounts and services].
IA-02(11) in IA-2	Remote Access — Separate Device withdrawn

Showing 400 of 1196; narrow with the search or a family.