NIST SP 800-53B (baselines) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| AC-01 | Policy and Procedures | ||
| AC-10 | Concurrent Session Control | ||
| AC-11 | Device Lock | ||
| AC-11(01) in AC-11 |
Pattern-hiding Displays | ||
| AC-12 | Session Termination | ||
| AC-14 | Permitted Actions Without Identification or Authentication | ||
| AC-17 | Remote Access | ||
| AC-17(01) in AC-17 |
Monitoring and Control | ||
| AC-17(02) in AC-17 |
Protection of Confidentiality and Integrity Using Encryption | ||
| AC-17(03) in AC-17 |
Managed Access Control Points | ||
| AC-17(04) in AC-17 |
Privileged Commands and Access | ||
| AC-18 | Wireless Access | ||
| AC-18(01) in AC-18 |
Authentication and Encryption | ||
| AC-18(03) in AC-18 |
Disable Wireless Networking | ||
| AC-18(04) in AC-18 |
Restrict Configurations by Users | ||
| AC-18(05) in AC-18 |
Antennas and Transmission Power Levels | ||
| AC-19 | Access Control for Mobile Devices | ||
| AC-19(05) in AC-19 |
Full Device or Container-based Encryption | ||
| AC-02 | Account Management | ||
| AC-02(01) in AC-2 |
Automated System Account Management | ||
| AC-02(11) in AC-2 |
Usage Conditions | ||
| AC-02(12) in AC-2 |
Account Monitoring for Atypical Usage | ||
| AC-02(13) in AC-2 |
Disable Accounts for High-risk Individuals | ||
| AC-02(02) in AC-2 |
Automated Temporary and Emergency Account Management | ||
| AC-02(03) in AC-2 |
Disable Accounts | ||
| AC-02(04) in AC-2 |
Automated Audit Actions | ||
| AC-02(05) in AC-2 |
Inactivity Logout | ||
| AC-20 | Use of External Systems | ||
| AC-20(01) in AC-20 |
Limits on Authorized Use | ||
| AC-20(02) in AC-20 |
Portable Storage Devices — Restricted Use | ||
| AC-21 | Information Sharing | ||
| AC-22 | Publicly Accessible Content | ||
| AC-03 | Access Enforcement | ||
| AC-04 | Information Flow Enforcement | ||
| AC-04(04) in AC-4 |
Flow Control of Encrypted Information | ||
| AC-05 | Separation of Duties | ||
| AC-06 | Least Privilege | ||
| AC-06(01) in AC-6 |
Authorize Access to Security Functions | ||
| AC-06(10) in AC-6 |
Prohibit Non-privileged Users from Executing Privileged Functions | ||
| AC-06(02) in AC-6 |
Non-privileged Access for Nonsecurity Functions | ||
| AC-06(03) in AC-6 |
Network Access to Privileged Commands | ||
| AC-06(05) in AC-6 |
Privileged Accounts | ||
| AC-06(07) in AC-6 |
Review of User Privileges | ||
| AC-06(09) in AC-6 |
Log Use of Privileged Functions | ||
| AC-07 | Unsuccessful Logon Attempts | ||
| AC-08 | System Use Notification | ||
| AT-01 | Policy and Procedures | ||
| AT-02 | Literacy Training and Awareness | ||
| AT-02(02) in AT-2 |
Insider Threat | ||
| AT-02(03) in AT-2 |
Social Engineering and Mining | ||
| AT-03 | Role-based Training | ||
| AT-04 | Training Records | ||
| AU-01 | Policy and Procedures | ||
| AU-10 | Non-repudiation | ||
| AU-11 | Audit Record Retention | ||
| AU-12 | Audit Record Generation | ||
| AU-12(01) in AU-12 |
System-wide and Time-correlated Audit Trail | ||
| AU-12(03) in AU-12 |
Changes by Authorized Individuals | ||
| AU-02 | Event Logging | ||
| AU-03 | Content of Audit Records | ||
| AU-03(01) in AU-3 |
Additional Audit Information | ||
| AU-04 | Audit Log Storage Capacity | ||
| AU-05 | Response to Audit Logging Process Failures | ||
| AU-05(01) in AU-5 |
Storage Capacity Warning | ||
| AU-05(02) in AU-5 |
Real-time Alerts | ||
| AU-06 | Audit Record Review, Analysis, and Reporting | ||
| AU-06(01) in AU-6 |
Automated Process Integration | ||
| AU-06(03) in AU-6 |
Correlate Audit Record Repositories | ||
| AU-06(05) in AU-6 |
Integrated Analysis of Audit Records | ||
| AU-06(06) in AU-6 |
Correlation with Physical Monitoring | ||
| AU-07 | Audit Record Reduction and Report Generation | ||
| AU-07(01) in AU-7 |
Automatic Processing | ||
| AU-08 | Time Stamps | ||
| AU-09 | Protection of Audit Information | ||
| AU-09(02) in AU-9 |
Store on Separate Physical Systems or Components | ||
| AU-09(03) in AU-9 |
Cryptographic Protection | ||
| AU-09(04) in AU-9 |
Access by Subset of Privileged Users | ||
| CA-01 | Policy and Procedures | ||
| CA-02 | Control Assessments | ||
| CA-02(01) in CA-2 |
Independent Assessors | ||
| CA-02(02) in CA-2 |
Specialized Assessments | ||
| CA-03 | Information Exchange | ||
| CA-03(06) in CA-3 |
Transfer Authorizations | ||
| CA-05 | Plan of Action and Milestones | ||
| CA-06 | Authorization | ||
| CA-07 | Continuous Monitoring | ||
| CA-07(01) in CA-7 |
Independent Assessment | ||
| CA-07(04) in CA-7 |
Risk Monitoring | ||
| CA-08 | Penetration Testing | ||
| CA-08(01) in CA-8 |
Independent Penetration Testing Agent or Team | ||
| CA-09 | Internal System Connections | ||
| CM-01 | Policy and Procedures | ||
| CM-10 | Software Usage Restrictions | ||
| CM-11 | User-installed Software | ||
| CM-12 | Information Location | ||
| CM-12(01) in CM-12 |
Automated Tools to Support Information Location | ||
| CM-02 | Baseline Configuration | ||
| CM-02(02) in CM-2 |
Automation Support for Accuracy and Currency | ||
| CM-02(03) in CM-2 |
Retention of Previous Configurations | ||
| CM-02(07) in CM-2 |
Configure Systems and Components for High-risk Areas | ||
| CM-03 | Configuration Change Control | ||
| CM-03(01) in CM-3 |
Automated Documentation, Notification, and Prohibition of Changes | ||
| CM-03(02) in CM-3 |
Testing, Validation, and Documentation of Changes | ||
| CM-03(04) in CM-3 |
Security and Privacy Representatives | ||
| CM-03(06) in CM-3 |
Cryptography Management | ||
| CM-04 | Impact Analyses | ||
| CM-04(01) in CM-4 |
Separate Test Environments | ||
| CM-04(02) in CM-4 |
Verification of Controls | ||
| CM-05 | Access Restrictions for Change | ||
| CM-05(01) in CM-5 |
Automated Access Enforcement and Audit Records | ||
| CM-06 | Configuration Settings | ||
| CM-06(01) in CM-6 |
Automated Management, Application, and Verification | ||
| CM-06(02) in CM-6 |
Respond to Unauthorized Changes | ||
| CM-07 | Least Functionality | ||
| CM-07(01) in CM-7 |
Periodic Review | ||
| CM-07(02) in CM-7 |
Prevent Program Execution | ||
| CM-07(05) in CM-7 |
Authorized Software — Allow-by-exception | ||
| CM-08 | System Component Inventory | ||
| CM-08(01) in CM-8 |
Updates During Installation and Removal | ||
| CM-08(02) in CM-8 |
Automated Maintenance | ||
| CM-08(03) in CM-8 |
Automated Unauthorized Component Detection | ||
| CM-08(04) in CM-8 |
Accountability Information | ||
| CM-09 | Configuration Management Plan | ||
| CP-01 | Policy and Procedures | ||
| CP-10 | System Recovery and Reconstitution | ||
| CP-10(02) in CP-10 |
Transaction Recovery | ||
| CP-10(04) in CP-10 |
Restore Within Time Period | ||
| CP-02 | Contingency Plan | ||
| CP-02(01) in CP-2 |
Coordinate with Related Plans | ||
| CP-02(02) in CP-2 |
Capacity Planning | ||
| CP-02(03) in CP-2 |
Resume Mission and Business Functions | ||
| CP-02(05) in CP-2 |
Continue Mission and Business Functions | ||
| CP-02(08) in CP-2 |
Identify Critical Assets | ||
| CP-03 | Contingency Training | ||
| CP-03(01) in CP-3 |
Simulated Events | ||
| CP-04 | Contingency Plan Testing | ||
| CP-04(01) in CP-4 |
Coordinate with Related Plans | ||
| CP-04(02) in CP-4 |
Alternate Processing Site | ||
| CP-06 | Alternate Storage Site | ||
| CP-06(01) in CP-6 |
Separation from Primary Site | ||
| CP-06(02) in CP-6 |
Recovery Time and Recovery Point Objectives | ||
| CP-06(03) in CP-6 |
Accessibility | ||
| CP-07 | Alternate Processing Site | ||
| CP-07(01) in CP-7 |
Separation from Primary Site | ||
| CP-07(02) in CP-7 |
Accessibility | ||
| CP-07(03) in CP-7 |
Priority of Service | ||
| CP-07(04) in CP-7 |
Preparation for Use | ||
| CP-08 | Telecommunications Services | ||
| CP-08(01) in CP-8 |
Priority of Service Provisions | ||
| CP-08(02) in CP-8 |
Single Points of Failure | ||
| CP-08(03) in CP-8 |
Separation of Primary and Alternate Providers | ||
| CP-08(04) in CP-8 |
Provider Contingency Plan | ||
| CP-09 | System Backup | ||
| CP-09(01) in CP-9 |
Testing for Reliability and Integrity | ||
| CP-09(02) in CP-9 |
Test Restoration Using Sampling | ||
| CP-09(03) in CP-9 |
Separate Storage for Critical Information | ||
| CP-09(05) in CP-9 |
Transfer to Alternate Storage Site | ||
| CP-09(08) in CP-9 |
Cryptographic Protection | ||
| IA-01 | Policy and Procedures | ||
| IA-11 | Re-authentication | ||
| IA-12 | Identity Proofing | ||
| IA-12(02) in IA-12 |
Identity Evidence | ||
| IA-12(03) in IA-12 |
Identity Evidence Validation and Verification | ||
| IA-12(04) in IA-12 |
In-person Validation and Verification | ||
| IA-12(05) in IA-12 |
Address Confirmation | ||
| IA-02 | Identification and Authentication (Organizational Users) | ||
| IA-02(01) in IA-2 |
Multi-factor Authentication to Privileged Accounts | ||
| IA-02(12) in IA-2 |
Acceptance of PIV Credentials | ||
| IA-02(02) in IA-2 |
Multi-factor Authentication to Non-privileged Accounts | ||
| IA-02(05) in IA-2 |
Individual Authentication with Group Authentication | ||
| IA-02(08) in IA-2 |
Access to Accounts — Replay Resistant | ||
| IA-03 | Device Identification and Authentication | ||
| IA-04 | Identifier Management | ||
| IA-04(04) in IA-4 |
Identify User Status | ||
| IA-05 | Authenticator Management | ||
| IA-05(01) in IA-5 |
Password-based Authentication | ||
| IA-05(02) in IA-5 |
Public Key-based Authentication | ||
| IA-05(06) in IA-5 |
Protection of Authenticators | ||
| IA-06 | Authentication Feedback | ||
| IA-07 | Cryptographic Module Authentication | ||
| IA-08 | Identification and Authentication (Non-organizational Users) | ||
| IA-08(01) in IA-8 |
Acceptance of PIV Credentials from Other Agencies | ||
| IA-08(02) in IA-8 |
Acceptance of External Authenticators | ||
| IA-08(04) in IA-8 |
Use of Defined Profiles | ||
| IR-01 | Policy and Procedures | ||
| IR-02 | Incident Response Training | ||
| IR-02(01) in IR-2 |
Simulated Events | ||
| IR-02(02) in IR-2 |
Automated Training Environments | ||
| IR-03 | Incident Response Testing | ||
| IR-03(02) in IR-3 |
Coordination with Related Plans | ||
| IR-04 | Incident Handling | ||
| IR-04(01) in IR-4 |
Automated Incident Handling Processes | ||
| IR-04(11) in IR-4 |
Integrated Incident Response Team | ||
| IR-04(04) in IR-4 |
Information Correlation | ||
| IR-05 | Incident Monitoring | ||
| IR-05(01) in IR-5 |
Automated Tracking, Data Collection, and Analysis | ||
| IR-06 | Incident Reporting | ||
| IR-06(01) in IR-6 |
Automated Reporting | ||
| IR-06(03) in IR-6 |
Supply Chain Coordination | ||
| IR-07 | Incident Response Assistance | ||
| IR-07(01) in IR-7 |
Automation Support for Availability of Information and Support | ||
| IR-08 | Incident Response Plan | ||
| MA-01 | Policy and Procedures | ||
| MA-02 | Controlled Maintenance | ||
| MA-02(02) in MA-2 |
Automated Maintenance Activities | ||
| MA-03 | Maintenance Tools | ||
| MA-03(01) in MA-3 |
Inspect Tools | ||
| MA-03(02) in MA-3 |
Inspect Media | ||
| MA-03(03) in MA-3 |
Prevent Unauthorized Removal | ||
| MA-04 | Nonlocal Maintenance | ||
| MA-04(03) in MA-4 |
Comparable Security and Sanitization | ||
| MA-05 | Maintenance Personnel | ||
| MA-05(01) in MA-5 |
Individuals Without Appropriate Access | ||
| MA-06 | Timely Maintenance | ||
| MP-01 | Policy and Procedures | ||
| MP-02 | Media Access | ||
| MP-03 | Media Marking | ||
| MP-04 | Media Storage | ||
| MP-05 | Media Transport | ||
| MP-06 | Media Sanitization | ||
| MP-06(01) in MP-6 |
Review, Approve, Track, Document, and Verify | ||
| MP-06(02) in MP-6 |
Equipment Testing | ||
| MP-06(03) in MP-6 |
Nondestructive Techniques | ||
| MP-07 | Media Use | ||
| PE-01 | Policy and Procedures | ||
| PE-10 | Emergency Shutoff | ||
| PE-11 | Emergency Power | ||
| PE-11(01) in PE-11 |
Alternate Power Supply — Minimal Operational Capability | ||
| PE-12 | Emergency Lighting | ||
| PE-13 | Fire Protection | ||
| PE-13(01) in PE-13 |
Detection Systems — Automatic Activation and Notification | ||
| PE-13(02) in PE-13 |
Suppression Systems — Automatic Activation and Notification | ||
| PE-14 | Environmental Controls | ||
| PE-15 | Water Damage Protection | ||
| PE-15(01) in PE-15 |
Automation Support | ||
| PE-16 | Delivery and Removal | ||
| PE-17 | Alternate Work Site | ||
| PE-18 | Location of System Components | ||
| PE-02 | Physical Access Authorizations | ||
| PE-03 | Physical Access Control | ||
| PE-03(01) in PE-3 |
System Access | ||
| PE-04 | Access Control for Transmission | ||
| PE-05 | Access Control for Output Devices | ||
| PE-06 | Monitoring Physical Access | ||
| PE-06(01) in PE-6 |
Intrusion Alarms and Surveillance Equipment | ||
| PE-06(04) in PE-6 |
Monitoring Physical Access to Systems | ||
| PE-08 | Visitor Access Records | ||
| PE-08(01) in PE-8 |
Automated Records Maintenance and Review | ||
| PE-09 | Power Equipment and Cabling | ||
| PL-01 | Policy and Procedures | ||
| PL-10 | Baseline Selection | ||
| PL-11 | Baseline Tailoring | ||
| PL-02 | System Security and Privacy Plans | ||
| PL-04 | Rules of Behavior | ||
| PL-04(01) in PL-4 |
Social Media and External Site/Application Usage Restrictions | ||
| PL-08 | Security and Privacy Architectures | ||
| PS-01 | Policy and Procedures | ||
| PS-02 | Position Risk Designation | ||
| PS-03 | Personnel Screening | ||
| PS-04 | Personnel Termination | ||
| PS-04(02) in PS-4 |
Automated Actions | ||
| PS-05 | Personnel Transfer | ||
| PS-06 | Access Agreements | ||
| PS-07 | External Personnel Security | ||
| PS-08 | Personnel Sanctions | ||
| PS-09 | Position Descriptions | ||
| RA-01 | Policy and Procedures | ||
| RA-02 | Security Categorization | ||
| RA-03 | Risk Assessment | ||
| RA-03(01) in RA-3 |
Supply Chain Risk Assessment | ||
| RA-05 | Vulnerability Monitoring and Scanning | ||
| RA-05(11) in RA-5 |
Public Disclosure Program | ||
| RA-05(02) in RA-5 |
Update Vulnerabilities to Be Scanned | ||
| RA-05(04) in RA-5 |
Discoverable Information | ||
| RA-05(05) in RA-5 |
Privileged Access | ||
| RA-07 | Risk Response | ||
| RA-09 | Criticality Analysis | ||
| SA-01 | Policy and Procedures | ||
| SA-10 | Developer Configuration Management | ||
| SA-11 | Developer Testing and Evaluation | ||
| SA-15 | Development Process, Standards, and Tools | ||
| SA-15(03) in SA-15 |
Criticality Analysis | ||
| SA-16 | Developer-provided Training | ||
| SA-17 | Developer Security and Privacy Architecture and Design | ||
| SA-02 | Allocation of Resources | ||
| SA-21 | Developer Screening | ||
| SA-22 | Unsupported System Components | ||
| SA-03 | System Development Life Cycle | ||
| SA-04 | Acquisition Process | ||
| SA-04(01) in SA-4 |
Functional Properties of Controls | ||
| SA-04(10) in SA-4 |
Use of Approved PIV Products | ||
| SA-04(02) in SA-4 |
Design and Implementation Information for Controls | ||
| SA-04(05) in SA-4 |
System, Component, and Service Configurations | ||
| SA-04(09) in SA-4 |
Functions, Ports, Protocols, and Services in Use | ||
| SA-05 | System Documentation | ||
| SA-08 | Security and Privacy Engineering Principles | ||
| SA-09 | External System Services | ||
| SA-09(02) in SA-9 |
Identification of Functions, Ports, Protocols, and Services | ||
| SC-01 | Policy and Procedures | ||
| SC-10 | Network Disconnect | ||
| SC-12 | Cryptographic Key Establishment and Management | ||
| SC-12(01) in SC-12 |
Availability | ||
| SC-13 | Cryptographic Protection | ||
| SC-15 | Collaborative Computing Devices and Applications | ||
| SC-17 | Public Key Infrastructure Certificates | ||
| SC-18 | Mobile Code | ||
| SC-02 | Separation of System and User Functionality | ||
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | ||
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | ||
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | ||
| SC-23 | Session Authenticity | ||
| SC-24 | Fail in Known State | ||
| SC-28 | Protection of Information at Rest | ||
| SC-28(01) in SC-28 |
Cryptographic Protection | ||
| SC-03 | Security Function Isolation | ||
| SC-39 | Process Isolation | ||
| SC-04 | Information in Shared System Resources | ||
| SC-05 | Denial-of-service Protection | ||
| SC-07 | Boundary Protection | ||
| SC-07(18) in SC-7 |
Fail Secure | ||
| SC-07(21) in SC-7 |
Isolation of System Components | ||
| SC-07(03) in SC-7 |
Access Points | ||
| SC-07(04) in SC-7 |
External Telecommunications Services | ||
| SC-07(05) in SC-7 |
Deny by Default — Allow by Exception | ||
| SC-07(07) in SC-7 |
Split Tunneling for Remote Devices | ||
| SC-07(08) in SC-7 |
Route Traffic to Authenticated Proxy Servers | ||
| SC-08 | Transmission Confidentiality and Integrity | ||
| SC-08(01) in SC-8 |
Cryptographic Protection | ||
| SI-01 | Policy and Procedures | ||
| SI-10 | Information Input Validation | ||
| SI-11 | Error Handling | ||
| SI-12 | Information Management and Retention | ||
| SI-16 | Memory Protection | ||
| SI-02 | Flaw Remediation | ||
| SI-02(02) in SI-2 |
Automated Flaw Remediation Status | ||
| SI-03 | Malicious Code Protection | ||
| SI-04 | System Monitoring | ||
| SI-04(10) in SI-4 |
Visibility of Encrypted Communications | ||
| SI-04(12) in SI-4 |
Automated Organization-generated Alerts | ||
| SI-04(14) in SI-4 |
Wireless Intrusion Detection | ||
| SI-04(02) in SI-4 |
Automated Tools and Mechanisms for Real-time Analysis | ||
| SI-04(20) in SI-4 |
Privileged Users | ||
| SI-04(22) in SI-4 |
Unauthorized Network Services | ||
| SI-04(04) in SI-4 |
Inbound and Outbound Communications Traffic | ||
| SI-04(05) in SI-4 |
System-generated Alerts | ||
| SI-05 | Security Alerts, Advisories, and Directives | ||
| SI-05(01) in SI-5 |
Automated Alerts and Advisories | ||
| SI-06 | Security and Privacy Function Verification | ||
| SI-07 | Software, Firmware, and Information Integrity | ||
| SI-07(01) in SI-7 |
Integrity Checks | ||
| SI-07(15) in SI-7 |
Code Authentication | ||
| SI-07(02) in SI-7 |
Automated Notifications of Integrity Violations | ||
| SI-07(05) in SI-7 |
Automated Response to Integrity Violations | ||
| SI-07(07) in SI-7 |
Integration of Detection and Response | ||
| SI-08 | Spam Protection | ||
| SI-08(02) in SI-8 |
Automatic Updates | ||
| SR-01 | Policy and Procedures | ||
| SR-10 | Inspection of Systems or Components | ||
| SR-11 | Component Authenticity | ||
| SR-11(01) in SR-11 |
Anti-counterfeit Training | ||
| SR-11(02) in SR-11 |
Configuration Control for Component Service and Repair | ||
| SR-12 | Component Disposal | ||
| SR-02 | Supply Chain Risk Management Plan | ||
| SR-02(01) in SR-2 |
Establish SCRM Team | ||
| SR-03 | Supply Chain Controls and Processes | ||
| SR-05 | Acquisition Strategies, Tools, and Methods | ||
| SR-06 | Supplier Assessments and Reviews | ||
| SR-08 | Notification Agreements | ||
| SR-09 | Tamper Resistance and Detection | ||
| SR-09(01) in SR-9 |
Multiple Stages of System Development Life Cycle |
370 of 370.