NIST SP 800-53 (controls) 5.1.1+u4
| Ref | Title | Text | |
|---|---|---|---|
| RA-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy that: (a) Addresses purpos | |
| RA-02 | Security Categorization | a. Categorize the system and information it processes, stores, and transmits; b. Document the security categorization results, including supporting rationale, in the security plan for the system; and c. Verify that the authorizing official | |
| RA-02(01) in RA-2 |
Impact-level Prioritization | Conduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels. | |
| RA-03 | Risk Assessment | a. Conduct a risk assessment, including: 1. Identifying threats to and vulnerabilities in the system; 2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of | |
| RA-03(01) in RA-3 |
Supply Chain Risk Assessment | (a) Assess supply chain risks associated with [Assignment: systems, system components, and system services] ; and (b) Update the supply chain risk assessment [Assignment: frequency] , when there are significant changes to the relevant suppl | |
| RA-03(02) in RA-3 |
Use of All-source Intelligence | Use all-source intelligence to assist in the analysis of risk. | |
| RA-03(03) in RA-3 |
Dynamic Threat Awareness | Determine the current cyber threat environment on an ongoing basis using [Assignment: means]. | |
| RA-03(04) in RA-3 |
Predictive Cyber Analytics | Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities]. | |
| RA-04 | Risk Assessment Update withdrawn | ||
| RA-05 | Vulnerability Monitoring and Scanning | a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting th | |
| RA-05(01) in RA-5 |
Update Tool Capability withdrawn | ||
| RA-05(02) in RA-5 |
Update Vulnerabilities to Be Scanned | Update the system vulnerabilities to be scanned [Selection (one or more): {{ insert: param, ra-05.02_odp.02 }} ; prior to a new scan; when new vulnerabilities are identified and reported]. | |
| RA-05(03) in RA-5 |
Breadth and Depth of Coverage | Define the breadth and depth of vulnerability scanning coverage. | |
| RA-05(04) in RA-5 |
Discoverable Information | Determine information about the system that is discoverable and take [Assignment: corrective actions]. | |
| RA-05(05) in RA-5 |
Privileged Access | Implement privileged access authorization to [Assignment: system components] for [Assignment: vulnerability scanning activities]. | |
| RA-05(06) in RA-5 |
Automated Trend Analyses | Compare the results of multiple vulnerability scans using [Assignment: automated mechanisms]. | |
| RA-05(07) in RA-5 |
Automated Detection and Notification of Unauthorized Components withdrawn | ||
| RA-05(08) in RA-5 |
Review Historic Audit Logs | Review historic audit logs to determine if a vulnerability identified in a [Assignment: system] has been previously exploited within an [Assignment: time period]. | |
| RA-05(09) in RA-5 |
Penetration Testing and Analyses withdrawn | ||
| RA-05(10) in RA-5 |
Correlate Scanning Information | Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors. | |
| RA-05(11) in RA-5 |
Public Disclosure Program | Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components. | |
| RA-06 | Technical Surveillance Countermeasures Survey | Employ a technical surveillance countermeasures survey at [Assignment: locations] [Selection (one or more): {{ insert: param, ra-06_odp.03 }} ; when {{ insert: param, ra-06_odp.04 }} ]. | |
| RA-07 | Risk Response | Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance. | |
| RA-08 | Privacy Impact Assessments | Conduct privacy impact assessments for systems, programs, or other activities before: a. Developing or procuring information technology that processes personally identifiable information; and b. Initiating a new collection of personally ide | |
| RA-09 | Criticality Analysis | Identify critical system components and functions by performing a criticality analysis for [Assignment: systems, system components, or system services] at [Assignment: decision points in the system development life cycle]. | |
| RA-10 | Threat Hunting | a. Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls; and b. Employ the threat hunting capab |
26 of 1193.