NIST SP 800-53B (baselines) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| AC-01 | Policy and Procedures | ||
| AC-14 | Permitted Actions Without Identification or Authentication | ||
| AC-17 | Remote Access | ||
| AC-18 | Wireless Access | ||
| AC-19 | Access Control for Mobile Devices | ||
| AC-02 | Account Management | ||
| AC-20 | Use of External Systems | ||
| AC-22 | Publicly Accessible Content | ||
| AC-03 | Access Enforcement | ||
| AC-07 | Unsuccessful Logon Attempts | ||
| AC-08 | System Use Notification | ||
| AT-01 | Policy and Procedures | ||
| AT-02 | Literacy Training and Awareness | ||
| AT-02(02) in AT-2 |
Insider Threat | ||
| AT-03 | Role-based Training | ||
| AT-04 | Training Records | ||
| AU-01 | Policy and Procedures | ||
| AU-11 | Audit Record Retention | ||
| AU-12 | Audit Record Generation | ||
| AU-02 | Event Logging | ||
| AU-03 | Content of Audit Records | ||
| AU-04 | Audit Log Storage Capacity | ||
| AU-05 | Response to Audit Logging Process Failures | ||
| AU-06 | Audit Record Review, Analysis, and Reporting | ||
| AU-08 | Time Stamps | ||
| AU-09 | Protection of Audit Information | ||
| CA-01 | Policy and Procedures | ||
| CA-02 | Control Assessments | ||
| CA-03 | Information Exchange | ||
| CA-05 | Plan of Action and Milestones | ||
| CA-06 | Authorization | ||
| CA-07 | Continuous Monitoring | ||
| CA-07(04) in CA-7 |
Risk Monitoring | ||
| CA-09 | Internal System Connections | ||
| CM-01 | Policy and Procedures | ||
| CM-10 | Software Usage Restrictions | ||
| CM-11 | User-installed Software | ||
| CM-02 | Baseline Configuration | ||
| CM-04 | Impact Analyses | ||
| CM-05 | Access Restrictions for Change | ||
| CM-06 | Configuration Settings | ||
| CM-07 | Least Functionality | ||
| CM-08 | System Component Inventory | ||
| CP-01 | Policy and Procedures | ||
| CP-10 | System Recovery and Reconstitution | ||
| CP-02 | Contingency Plan | ||
| CP-03 | Contingency Training | ||
| CP-04 | Contingency Plan Testing | ||
| CP-09 | System Backup | ||
| IA-01 | Policy and Procedures | ||
| IA-11 | Re-authentication | ||
| IA-02 | Identification and Authentication (Organizational Users) | ||
| IA-02(01) in IA-2 |
Multi-factor Authentication to Privileged Accounts | ||
| IA-02(12) in IA-2 |
Acceptance of PIV Credentials | ||
| IA-02(02) in IA-2 |
Multi-factor Authentication to Non-privileged Accounts | ||
| IA-02(08) in IA-2 |
Access to Accounts — Replay Resistant | ||
| IA-04 | Identifier Management | ||
| IA-05 | Authenticator Management | ||
| IA-05(01) in IA-5 |
Password-based Authentication | ||
| IA-06 | Authentication Feedback | ||
| IA-07 | Cryptographic Module Authentication | ||
| IA-08 | Identification and Authentication (Non-organizational Users) | ||
| IA-08(01) in IA-8 |
Acceptance of PIV Credentials from Other Agencies | ||
| IA-08(02) in IA-8 |
Acceptance of External Authenticators | ||
| IA-08(04) in IA-8 |
Use of Defined Profiles | ||
| IR-01 | Policy and Procedures | ||
| IR-02 | Incident Response Training | ||
| IR-04 | Incident Handling | ||
| IR-05 | Incident Monitoring | ||
| IR-06 | Incident Reporting | ||
| IR-07 | Incident Response Assistance | ||
| IR-08 | Incident Response Plan | ||
| MA-01 | Policy and Procedures | ||
| MA-02 | Controlled Maintenance | ||
| MA-04 | Nonlocal Maintenance | ||
| MA-05 | Maintenance Personnel | ||
| MP-01 | Policy and Procedures | ||
| MP-02 | Media Access | ||
| MP-06 | Media Sanitization | ||
| MP-07 | Media Use | ||
| PE-01 | Policy and Procedures | ||
| PE-12 | Emergency Lighting | ||
| PE-13 | Fire Protection | ||
| PE-14 | Environmental Controls | ||
| PE-15 | Water Damage Protection | ||
| PE-16 | Delivery and Removal | ||
| PE-02 | Physical Access Authorizations | ||
| PE-03 | Physical Access Control | ||
| PE-06 | Monitoring Physical Access | ||
| PE-08 | Visitor Access Records | ||
| PL-01 | Policy and Procedures | ||
| PL-10 | Baseline Selection | ||
| PL-11 | Baseline Tailoring | ||
| PL-02 | System Security and Privacy Plans | ||
| PL-04 | Rules of Behavior | ||
| PL-04(01) in PL-4 |
Social Media and External Site/Application Usage Restrictions | ||
| PS-01 | Policy and Procedures | ||
| PS-02 | Position Risk Designation | ||
| PS-03 | Personnel Screening | ||
| PS-04 | Personnel Termination | ||
| PS-05 | Personnel Transfer | ||
| PS-06 | Access Agreements | ||
| PS-07 | External Personnel Security | ||
| PS-08 | Personnel Sanctions | ||
| PS-09 | Position Descriptions | ||
| RA-01 | Policy and Procedures | ||
| RA-02 | Security Categorization | ||
| RA-03 | Risk Assessment | ||
| RA-03(01) in RA-3 |
Supply Chain Risk Assessment | ||
| RA-05 | Vulnerability Monitoring and Scanning | ||
| RA-05(11) in RA-5 |
Public Disclosure Program | ||
| RA-05(02) in RA-5 |
Update Vulnerabilities to Be Scanned | ||
| RA-07 | Risk Response | ||
| SA-01 | Policy and Procedures | ||
| SA-02 | Allocation of Resources | ||
| SA-22 | Unsupported System Components | ||
| SA-03 | System Development Life Cycle | ||
| SA-04 | Acquisition Process | ||
| SA-04(10) in SA-4 |
Use of Approved PIV Products | ||
| SA-05 | System Documentation | ||
| SA-08 | Security and Privacy Engineering Principles | ||
| SA-09 | External System Services | ||
| SC-01 | Policy and Procedures | ||
| SC-12 | Cryptographic Key Establishment and Management | ||
| SC-13 | Cryptographic Protection | ||
| SC-15 | Collaborative Computing Devices and Applications | ||
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | ||
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | ||
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | ||
| SC-39 | Process Isolation | ||
| SC-05 | Denial-of-service Protection | ||
| SC-07 | Boundary Protection | ||
| SI-01 | Policy and Procedures | ||
| SI-12 | Information Management and Retention | ||
| SI-02 | Flaw Remediation | ||
| SI-03 | Malicious Code Protection | ||
| SI-04 | System Monitoring | ||
| SI-05 | Security Alerts, Advisories, and Directives | ||
| SR-01 | Policy and Procedures | ||
| SR-10 | Inspection of Systems or Components | ||
| SR-11 | Component Authenticity | ||
| SR-11(01) in SR-11 |
Anti-counterfeit Training | ||
| SR-11(02) in SR-11 |
Configuration Control for Component Service and Repair | ||
| SR-12 | Component Disposal | ||
| SR-02 | Supply Chain Risk Management Plan | ||
| SR-02(01) in SR-2 |
Establish SCRM Team | ||
| SR-03 | Supply Chain Controls and Processes | ||
| SR-05 | Acquisition Strategies, Tools, and Methods | ||
| SR-08 | Notification Agreements |
149 of 149.