NIST SP 800-53B (baselines) 5.1.1+u4
| Ref | Title | Text | |
|---|---|---|---|
| AC-01 | Policy and Procedures | ||
| AC-03(14) in AC-3 |
Individual Access | ||
| AT-01 | Policy and Procedures | ||
| AT-02 | Literacy Training and Awareness | ||
| AT-03 | Role-based Training | ||
| AT-03(05) in AT-3 |
Processing Personally Identifiable Information | ||
| AT-04 | Training Records | ||
| AU-01 | Policy and Procedures | ||
| AU-11 | Audit Record Retention | ||
| AU-02 | Event Logging | ||
| AU-03(03) in AU-3 |
Limit Personally Identifiable Information Elements | ||
| CA-01 | Policy and Procedures | ||
| CA-02 | Control Assessments | ||
| CA-05 | Plan of Action and Milestones | ||
| CA-06 | Authorization | ||
| CA-07 | Continuous Monitoring | ||
| CA-07(04) in CA-7 |
Risk Monitoring | ||
| CM-01 | Policy and Procedures | ||
| CM-04 | Impact Analyses | ||
| IR-01 | Policy and Procedures | ||
| IR-02 | Incident Response Training | ||
| IR-02(03) in IR-2 |
Breach | ||
| IR-03 | Incident Response Testing | ||
| IR-04 | Incident Handling | ||
| IR-05 | Incident Monitoring | ||
| IR-06 | Incident Reporting | ||
| IR-07 | Incident Response Assistance | ||
| IR-08 | Incident Response Plan | ||
| IR-08(01) in IR-8 |
Breaches | ||
| MP-01 | Policy and Procedures | ||
| MP-06 | Media Sanitization | ||
| PE-08(03) in PE-8 |
Limit Personally Identifiable Information Elements | ||
| PL-01 | Policy and Procedures | ||
| PL-02 | System Security and Privacy Plans | ||
| PL-04 | Rules of Behavior | ||
| PL-04(01) in PL-4 |
Social Media and External Site/Application Usage Restrictions | ||
| PL-08 | Security and Privacy Architectures | ||
| PL-09 | Central Management | ||
| PM-10 | Authorization Process | ||
| PM-11 | Mission and Business Process Definition | ||
| PM-13 | Security and Privacy Workforce | ||
| PM-14 | Testing, Training, and Monitoring | ||
| PM-17 | Protecting Controlled Unclassified Information on External Systems | ||
| PM-18 | Privacy Program Plan | ||
| PM-19 | Privacy Program Leadership Role | ||
| PM-20 | Dissemination of Privacy Program Information | ||
| PM-20(01) in PM-20 |
Privacy Policies on Websites, Applications, and Digital Services | ||
| PM-21 | Accounting of Disclosures | ||
| PM-22 | Personally Identifiable Information Quality Management | ||
| PM-24 | Data Integrity Board | ||
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | ||
| PM-26 | Complaint Management | ||
| PM-27 | Privacy Reporting | ||
| PM-28 | Risk Framing | ||
| PM-03 | Information Security and Privacy Resources | ||
| PM-31 | Continuous Monitoring Strategy | ||
| PM-04 | Plan of Action and Milestones Process | ||
| PM-05(01) in PM-5 |
Inventory of Personally Identifiable Information | ||
| PM-06 | Measures of Performance | ||
| PM-07 | Enterprise Architecture | ||
| PM-08 | Critical Infrastructure Plan | ||
| PM-09 | Risk Management Strategy | ||
| PS-06 | Access Agreements | ||
| PT-01 | Policy and Procedures | ||
| PT-02 | Authority to Process Personally Identifiable Information | ||
| PT-03 | Personally Identifiable Information Processing Purposes | ||
| PT-04 | Consent | ||
| PT-05 | Privacy Notice | ||
| PT-05(02) in PT-5 |
Privacy Act Statements | ||
| PT-06 | System of Records Notice | ||
| PT-06(01) in PT-6 |
Routine Uses | ||
| PT-06(02) in PT-6 |
Exemption Rules | ||
| PT-07 | Specific Categories of Personally Identifiable Information | ||
| PT-07(01) in PT-7 |
Social Security Numbers | ||
| PT-07(02) in PT-7 |
First Amendment Information | ||
| PT-08 | Computer Matching Requirements | ||
| RA-01 | Policy and Procedures | ||
| RA-03 | Risk Assessment | ||
| RA-07 | Risk Response | ||
| RA-08 | Privacy Impact Assessments | ||
| SA-01 | Policy and Procedures | ||
| SA-11 | Developer Testing and Evaluation | ||
| SA-02 | Allocation of Resources | ||
| SA-03 | System Development Life Cycle | ||
| SA-04 | Acquisition Process | ||
| SA-08(33) in SA-8 |
Minimization | ||
| SA-09 | External System Services | ||
| SC-07(24) in SC-7 |
Personally Identifiable Information | ||
| SI-01 | Policy and Procedures | ||
| SI-12 | Information Management and Retention | ||
| SI-12(01) in SI-12 |
Limit Personally Identifiable Information Elements | ||
| SI-12(02) in SI-12 |
Minimize Personally Identifiable Information in Testing, Training, and Research | ||
| SI-12(03) in SI-12 |
Information Disposal | ||
| SI-18 | Personally Identifiable Information Quality Operations | ||
| SI-18(04) in SI-18 |
Individual Requests | ||
| SI-19 | De-identification |
96 of 96.