NIST-800-53.yaml

name: NIST-800-53
AC-1:
  name: Access Control Policy and Procedures
  family: Access Control
  description: |
    The organization:
      - **AC-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **AC-1a.1.** An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **AC-1a.2.** Procedures to facilitate the implementation of the access control policy and associated access controls; and
      - **AC-1b.** Reviews and updates the current:
        - **AC-1b.1.** Access control policy _[Assignment: organization-defined frequency]_; and
        - **AC-1b.2.** Access control procedures _[Assignment: organization-defined frequency]_.
AC-2:
  name: Account Management
  family: Access Control
  description: |
    The organization:
      - **AC-2a.** Identifies and selects the following types of information system accounts to support organizational missions/business functions: _[Assignment: organization-defined information system account types]_;
      - **AC-2b.** Assigns account managers for information system accounts;
      - **AC-2c.** Establishes conditions for group and role membership;
      - **AC-2d.** Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
      - **AC-2e.** Requires approvals by _[Assignment: organization-defined personnel or roles]_ for requests to create information system accounts;
      - **AC-2f.** Creates, enables, modifies, disables, and removes information system accounts in accordance with _[Assignment: organization-defined procedures or conditions]_;
      - **AC-2g.** Monitors the use of information system accounts;
      - **AC-2h.** Notifies account managers:
        - **AC-2h.1.** When accounts are no longer required;
        - **AC-2h.2.** When users are terminated or transferred; and
        - **AC-2h.3.** When individual information system usage or need-to-know changes;
      - **AC-2i.** Authorizes access to the information system based on:
        - **AC-2i.1.** A valid access authorization;
        - **AC-2i.2.** Intended system usage; and
        - **AC-2i.3.** Other attributes as required by the organization or associated missions/business functions;
      - **AC-2j.** Reviews accounts for compliance with account management requirements _[Assignment: organization-defined frequency]_; and
      - **AC-2k.** Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-2 (1):
  name: Automated System Account Management
  family: Access Control
  description: |
    The organization employs automated mechanisms to support the management of information system accounts.
AC-2 (2):
  name: Removal of Temporary / Emergency Accounts
  family: Access Control
  description: |
    The information system automatically [Selection: removes; disables] temporary and emergency accounts after _[Assignment: organization-defined time period for each type of account]_.
AC-2 (3):
  name: Disable Inactive Accounts
  family: Access Control
  description: |
    The information system automatically disables inactive accounts after _[Assignment: organization-defined time period]_.
AC-2 (4):
  name: Automated Audit Actions
  family: Access Control
  description: |
    The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies _[Assignment: organization-defined personnel or roles]_.
AC-2 (5):
  name: Inactivity Logout
  family: Access Control
  description: |
    The organization requires that users log out when _[Assignment: organization-defined time-period of expected inactivity or description of when to log out]_.
AC-2 (6):
  name: Dynamic Privilege Management
  family: Access Control
  description: |
    The information system implements the following dynamic privilege management capabilities: _[Assignment: organization-defined list of dynamic privilege management capabilities]_.
AC-2 (7):
  name: Role-based Schemes
  family: Access Control
  description: |
    The organization:
      - **AC-2 (7)(a)** Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;
      - **AC-2 (7)(b)** Monitors privileged role assignments; and
      - **AC-2 (7)(c)** Takes _[Assignment: organization-defined actions]_ when privileged role assignments are no longer appropriate.
AC-2 (8):
  name: Dynamic Account Creation
  family: Access Control
  description: |
    The information system creates _[Assignment: organization-defined information system accounts]_ dynamically.
AC-2 (9):
  name: Restrictions on Use of Shared / Group Accounts
  family: Access Control
  description: |
    The organization only permits the use of shared/group accounts that meet _[Assignment: organization-defined conditions for establishing shared/group accounts]_.
AC-2 (10):
  name: Shared / Group Account Credential Termination
  family: Access Control
  description: |
    The information system terminates shared/group account credentials when members leave the group.
AC-2 (11):
  name: Usage Conditions
  family: Access Control
  description: |
    The information system enforces _[Assignment: organization-defined circumstances and/or usage conditions]_ for _[Assignment: organization-defined information system accounts]_.
AC-2 (12):
  name: Account Monitoring / Atypical Usage
  family: Access Control
  description: |
    The organization:
      - **AC-2 (12)(a)** Monitors information system accounts for _[Assignment: organization-defined atypical usage]_; and
      - **AC-2 (12)(b)** Reports atypical usage of information system accounts to _[Assignment: organization-defined personnel or roles]_.
AC-2 (13):
  name: Disable Accounts for High-risk Individuals
  family: Access Control
  description: |
    The organization disables accounts of users posing a significant risk within _[Assignment: organization-defined time period]_ of discovery of the risk.
AC-3:
  name: Access Enforcement
  family: Access Control
  description: |
    The information system enforces approved authorizations for logical access to information           and system resources in accordance with applicable access control policies.
AC-3 (1):
  name: Restricted Access to Privileged Functions
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into AC-6]_.
AC-3 (2):
  name: Dual Authorization
  family: Access Control
  description: |
    The information system enforces dual authorization for _[Assignment: organization-defined privileged commands and/or other organization-defined actions]_.
AC-3 (3):
  name: Mandatory Access Control
  family: Access Control
  description: |
    The information system enforces _[Assignment: organization-defined mandatory access control policy]_ over all subjects and objects where the policy:
      - **AC-3 (3)(a)** Is uniformly enforced across all subjects and objects within the boundary of the information system;
      - **AC-3 (3)(b)** Specifies that a subject that has been granted access to information is constrained from doing any of the following;
        - **AC-3 (3)(b)(1)** Passing the information to unauthorized subjects or objects;
        - **AC-3 (3)(b)(2)** Granting its privileges to other subjects;
        - **AC-3 (3)(b)(3)** Changing one or more security attributes on subjects, objects, the information system, or information system components;
        - **AC-3 (3)(b)(4)** Choosing the security attributes and attribute values to be associated with newly created or modified objects; or
        - **AC-3 (3)(b)(5)** Changing the rules governing access control; and
      - **AC-3 (3)(c)** Specifies that _[Assignment: organization-defined subjects]_ may explicitly be granted _[Assignment: organization-defined privileges (i.e., they are trusted subjects)]_ such that they are not limited by some or all of the above constraints.
AC-3 (4):
  name: Discretionary Access Control
  family: Access Control
  description: |
    The information system enforces _[Assignment: organization-defined discretionary access control policy]_ over defined subjects and objects where the policy specifies that a subject that has been granted access to information can do one or more of the following:
      - **AC-3 (4)(a)** Pass the  information to any other subjects or objects;
      - **AC-3 (4)(b)** Grant its privileges to other subjects;
      - **AC-3 (4)(c)** Change security attributes on subjects, objects, the information system, or the information system's components;
      - **AC-3 (4)(d)** Choose the security attributes to be associated with newly created or revised objects; or
      - **AC-3 (4)(e)** Change the rules governing access control.
AC-3 (5):
  name: Security-relevant Information
  family: Access Control
  description: |
    The information system prevents access to _[Assignment: organization-defined security-relevant information]_ except during secure, non-operable system states.
AC-3 (6):
  name: Protection of User and System Information
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into MP-4 and SC-28]_.
AC-3 (7):
  name: Role-based Access Control
  family: Access Control
  description: |
    The information system enforces a role-based access control policy over defined subjects and objects and controls access based upon _[Assignment: organization-defined roles and users authorized to assume such roles]_.
AC-3 (8):
  name: Revocation of Access Authorizations
  family: Access Control
  description: |
    The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on _[Assignment: organization-defined rules governing the timing of revocations of access authorizations]_.
AC-3 (9):
  name: Controlled Release
  family: Access Control
  description: |
    The information system does not release information outside of the established system boundary unless:
      - **AC-3 (9)(a)** The receiving _[Assignment: organization-defined information system or system component]_ provides _[Assignment: organization-defined security safeguards]_; and
      - **AC-3 (9)(b)** _[Assignment: organization-defined security safeguards]_ are used to validate the appropriateness of the information designated for release.
AC-3 (10):
  name: Audited Override of Access Control Mechanisms
  family: Access Control
  description: |
    The organization employs an audited override of automated access control mechanisms under _[Assignment: organization-defined conditions]_.
AC-4:
  name: Information Flow Enforcement
  family: Access Control
  description: |
    The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on _[Assignment: organization-defined information flow control policies]_.
AC-4 (1):
  name: Object Security Attributes
  family: Access Control
  description: |
    The information system uses _[Assignment: organization-defined security attributes]_ associated with _[Assignment: organization-defined information, source, and destination objects]_ to enforce _[Assignment: organization-defined information flow control policies]_ as a basis for flow control decisions.
AC-4 (2):
  name: Processing Domains
  family: Access Control
  description: |
    The information system uses protected processing domains to enforce _[Assignment: organization-defined information flow control policies]_ as a basis for flow control decisions.
AC-4 (3):
  name: Dynamic Information Flow Control
  family: Access Control
  description: |
    The information system enforces dynamic information flow control based on _[Assignment: organization-defined policies]_.
AC-4 (4):
  name: Content Check Encrypted Information
  family: Access Control
  description: |
    The information system prevents encrypted information from bypassing content-checking mechanisms by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; _[Assignment: organization-defined procedure or method]_].
AC-4 (5):
  name: Embedded Data Types
  family: Access Control
  description: |
    The information system enforces _[Assignment: organization-defined limitations]_ on embedding data types within other data types.
AC-4 (6):
  name: Metadata
  family: Access Control
  description: |
    The information system enforces information flow control based on _[Assignment: organization-defined metadata]_.
AC-4 (7):
  name: One-way Flow Mechanisms
  family: Access Control
  description: |
    The information system enforces _[Assignment: organization-defined one-way information flows]_ using hardware mechanisms.
AC-4 (8):
  name: Security Policy Filters
  family: Access Control
  description: |
    The information system enforces information flow control using _[Assignment: organization-defined security policy filters]_ as a basis for flow control decisions for _[Assignment: organization-defined information flows]_.
AC-4 (9):
  name: Human Reviews
  family: Access Control
  description: |
    The information system enforces the use of human reviews for _[Assignment: organization-defined information flows]_ under the following conditions: _[Assignment: organization-defined conditions]_.
AC-4 (10):
  name: Enable / Disable Security Policy Filters
  family: Access Control
  description: |
    The information system provides the capability for privileged administrators to enable/disable _[Assignment: organization-defined security policy filters]_ under the following conditions: _[Assignment: organization-defined conditions]_.
AC-4 (11):
  name: Configuration of Security Policy Filters
  family: Access Control
  description: |
    The information system provides the capability for privileged administrators to configure _[Assignment: organization-defined security policy filters]_ to support different security policies.
AC-4 (12):
  name: Data Type Identifiers
  family: Access Control
  description: |
    The information system, when transferring information between different security domains, uses _[Assignment: organization-defined data type identifiers]_ to validate data essential for information flow decisions.
AC-4 (13):
  name: Decomposition Into Policy-relevant Subcomponents
  family: Access Control
  description: |
    The information system, when transferring information between different security domains, decomposes information into _[Assignment: organization-defined policy-relevant subcomponents]_ for submission to policy enforcement mechanisms.
AC-4 (14):
  name: Security Policy Filter Constraints
  family: Access Control
  description: |
    The information system, when transferring information between different security domains, implements _[Assignment: organization-defined security policy filters]_ requiring fully enumerated formats that restrict data structure and content.
AC-4 (15):
  name: Detection of Unsanctioned Information
  family: Access Control
  description: |
    The information system, when transferring information between different security domains, examines the information for the presence of _[Assignment: organized-defined unsanctioned information]_ and prohibits the transfer of such information in accordance with the _[Assignment: organization-defined security policy]_.
AC-4 (16):
  name: Information Transfers on Interconnected Systems
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into AC-4]_.
AC-4 (17):
  name: Domain Authentication
  family: Access Control
  description: |
    The information system uniquely identifies and authenticates source and destination points by [Selection (one or more): organization, system, application, individual] for information transfer.
AC-4 (18):
  name: Security Attribute Binding
  family: Access Control
  description: |
    The information system binds security attributes to information using _[Assignment: organization-defined binding techniques]_ to facilitate information flow policy enforcement.
AC-4 (19):
  name: Validation of Metadata
  family: Access Control
  description: |
    The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.
AC-4 (20):
  name: Approved Solutions
  family: Access Control
  description: |
    The organization employs _[Assignment: organization-defined solutions in approved configurations]_ to control the flow of _[Assignment: organization-defined information]_ across security domains.
AC-4 (21):
  name: Physical / Logical Separation of Information Flows
  family: Access Control
  description: |
    The information system separates information flows logically or physically using _[Assignment: organization-defined mechanisms and/or techniques]_ to accomplish _[Assignment: organization-defined required separations by types of information]_.
AC-4 (22):
  name: Access Only
  family: Access Control
  description: |
    The information system provides access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.
AC-5:
  name: Separation of Duties
  family: Access Control
  description: |
    The organization:
      - **AC-5a.** Separates _[Assignment: organization-defined duties of individuals]_;
      - **AC-5b.** Documents separation of duties of individuals; and
      - **AC-5c.** Defines information system access authorizations to support separation of duties.
AC-6:
  name: Least Privilege
  family: Access Control
  description: |
    The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-6 (1):
  name: Authorize Access to Security Functions
  family: Access Control
  description: |
    The organization explicitly authorizes access to _[Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information]_.
AC-6 (2):
  name: Non-privileged Access for Nonsecurity Functions
  family: Access Control
  description: |
    The organization requires that users of information system accounts, or roles, with access to _[Assignment: organization-defined security functions or security-relevant information]_, use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-6 (3):
  name: Network Access to Privileged Commands
  family: Access Control
  description: |
    The organization authorizes network access to _[Assignment: organization-defined privileged commands]_ only for _[Assignment: organization-defined compelling operational needs]_ and documents the rationale for such access in the security plan for the information system.
AC-6 (4):
  name: Separate Processing Domains
  family: Access Control
  description: |
    The information system provides separate processing domains to enable finer-grained allocation of user privileges.
AC-6 (5):
  name: Privileged Accounts
  family: Access Control
  description: |
    The organization restricts privileged accounts on the information system to _[Assignment: organization-defined personnel or roles]_.
AC-6 (6):
  name: Privileged Access by Non-organizational Users
  family: Access Control
  description: |
    The organization prohibits privileged access to the information system by non-organizational users.
AC-6 (7):
  name: Review of User Privileges
  family: Access Control
  description: |
    The organization:
      - **AC-6 (7)(a)** Reviews _[Assignment: organization-defined frequency]_ the privileges assigned to _[Assignment: organization-defined roles or classes of users]_ to validate the need for such privileges; and
      - **AC-6 (7)(b)** Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
AC-6 (8):
  name: Privilege Levels for Code Execution
  family: Access Control
  description: |
    The information system prevents _[Assignment: organization-defined software]_ from executing at higher privilege levels than users executing the software.
AC-6 (9):
  name: Auditing Use of Privileged Functions
  family: Access Control
  description: |
    The information system audits the execution of privileged functions.
AC-6 (10):
  name: Prohibit Non-privileged Users From Executing Privileged Functions
  family: Access Control
  description: |
    The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
AC-7:
  name: Unsuccessful Logon Attempts
  family: Access Control
  description: |
    The information system:
      - **AC-7a.** Enforces a limit of _[Assignment: organization-defined number]_ consecutive invalid logon attempts by a user during a _[Assignment: organization-defined time period]_; and
      - **AC-7b.** Automatically [Selection: locks the account/node for an _[Assignment: organization-defined time period]_; locks the account/node until released by an administrator; delays next logon prompt according to _[Assignment: organization-defined delay algorithm]_] when the maximum number of unsuccessful attempts is exceeded.
AC-7 (1):
  name: Automatic Account Lock
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into AC-7]_.
AC-7 (2):
  name: Purge / Wipe Mobile Device
  family: Access Control
  description: |
    The information system purges/wipes information from _[Assignment: organization-defined mobile devices]_ based on _[Assignment: organization-defined purging/wiping requirements/techniques]_ after _[Assignment: organization-defined number]_ consecutive, unsuccessful device logon attempts.
AC-8:
  name: System Use Notification
  family: Access Control
  description: |
    The information system:
      - **AC-8a.** Displays to users _[Assignment: organization-defined system use notification message or banner]_ before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:
        - **AC-8a.1.** Users are accessing a U.S. Government information system;
        - **AC-8a.2.** Information system usage may be monitored, recorded, and subject to audit;
        - **AC-8a.3.** Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and
        - **AC-8a.4.** Use of the information system indicates consent to monitoring and recording;
      - **AC-8b.** Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and
      - **AC-8c.** For publicly accessible systems:
        - **AC-8c.1.** Displays system use information _[Assignment: organization-defined conditions]_, before granting further access;
        - **AC-8c.2.** Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
        - **AC-8c.3.** Includes a description of the authorized uses of the system.
AC-9:
  name: Previous Logon (access) Notification
  family: Access Control
  description: |
    The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).
AC-9 (1):
  name: Unsuccessful Logons
  family: Access Control
  description: |
    The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.
AC-9 (2):
  name: Successful / Unsuccessful Logons
  family: Access Control
  description: |
    The information system notifies the user of the number of [Selection: successful logons/accesses; unsuccessful logon/access attempts; both] during _[Assignment: organization-defined time period]_.
AC-9 (3):
  name: Notification of Account Changes
  family: Access Control
  description: |
    The information system notifies the user of changes to _[Assignment: organization-defined security-related characteristics/parameters of the user's account]_ during _[Assignment: organization-defined time period]_.
AC-9 (4):
  name: Additional Logon Information
  family: Access Control
  description: |
    The information system notifies the user, upon successful logon (access), of the following additional information: _[Assignment: organization-defined information to be included in addition to the date and time of the last logon (access)]_.
AC-10:
  name: Concurrent Session Control
  family: Access Control
  description: |
    The information system limits the number of concurrent sessions for each _[Assignment: organization-defined account and/or account type]_ to _[Assignment: organization-defined number]_.
AC-11:
  name: Session Lock
  family: Access Control
  description: |
    The information system:
      - **AC-11a.** Prevents further access to the system by initiating a session lock after _[Assignment: organization-defined time period]_ of inactivity or upon receiving a request from a user; and
      - **AC-11b.** Retains the session lock until the user reestablishes access using established identification and authentication procedures.
AC-11 (1):
  name: Pattern-hiding Displays
  family: Access Control
  description: |
    The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.
AC-12:
  name: Session Termination
  family: Access Control
  description: |
    The information system automatically terminates a user session after _[Assignment: organization-defined conditions or trigger events requiring session disconnect]_.
AC-12 (1):
  name: User-initiated Logouts / Message Displays
  family: Access Control
  description: |
    The information system:
      - **AC-12 (1)(a)** Provides a logout capability for user-initiated communications sessions whenever authentication is used to gain access to _[Assignment: organization-defined information resources]_; and
      - **AC-12 (1)(b)** Displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.
AC-13:
  name: Supervision and Review - Access Control
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into AC-2 and AU-6]_.
AC-14:
  name: Permitted Actions Without Identification or Authentication
  family: Access Control
  description: |
    The organization:
      - **AC-14a.** Identifies _[Assignment: organization-defined user actions]_ that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and
      - **AC-14b.** Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.
AC-14 (1):
  name: Necessary Uses
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into AC-14]_.
AC-15:
  name: Automated Marking
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into MP-3]_.
AC-16:
  name: Security Attributes
  family: Access Control
  description: |
    The organization:
      - **AC-16a.** Provides the means to associate _[Assignment: organization-defined types of security attributes]_ having _[Assignment: organization-defined security attribute values]_ with information in storage, in process, and/or in transmission;
      - **AC-16b.** Ensures that the security attribute associations are made and retained with the information;
      - **AC-16c.** Establishes the permitted _[Assignment: organization-defined security attributes]_ for _[Assignment: organization-defined information systems]_; and
      - **AC-16d.** Determines the permitted _[Assignment: organization-defined values or ranges]_ for each of the established security attributes.
AC-16 (1):
  name: Dynamic Attribute Association
  family: Access Control
  description: |
    The information system dynamically associates security attributes with _[Assignment: organization-defined subjects and objects]_ in accordance with _[Assignment: organization-defined security policies]_ as information is created and combined.
AC-16 (2):
  name: Attribute Value Changes by Authorized Individuals
  family: Access Control
  description: |
    The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security attributes.
AC-16 (3):
  name: Maintenance of Attribute Associations by Information System
  family: Access Control
  description: |
    The information system maintains the association and integrity of _[Assignment: organization-defined security attributes]_ to _[Assignment: organization-defined subjects and objects]_.
AC-16 (4):
  name: Association of Attributes by Authorized Individuals
  family: Access Control
  description: |
    The information system supports the association of _[Assignment: organization-defined security attributes]_ with _[Assignment: organization-defined subjects and objects]_ by authorized individuals (or processes acting on behalf of individuals).
AC-16 (5):
  name: Attribute Displays for Output Devices
  family: Access Control
  description: |
    The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify _[Assignment: organization-identified special dissemination, handling, or distribution instructions]_ using _[Assignment: organization-identified human-readable, standard naming conventions]_.
AC-16 (6):
  name: Maintenance of Attribute Association by Organization
  family: Access Control
  description: |
    The organization allows personnel to associate, and maintain the association of _[Assignment: organization-defined security attributes]_ with _[Assignment: organization-defined subjects and objects]_ in accordance with _[Assignment: organization-defined security policies]_.
AC-16 (7):
  name: Consistent Attribute Interpretation
  family: Access Control
  description: |
    The organization provides a consistent interpretation of security attributes transmitted between distributed information system components.
AC-16 (8):
  name: Association Techniques / Technologies
  family: Access Control
  description: |
    The information system implements _[Assignment: organization-defined techniques or technologies]_ with _[Assignment: organization-defined level of assurance]_ in associating security attributes to information.
AC-16 (9):
  name: Attribute Reassignment
  family: Access Control
  description: |
    The organization ensures that security attributes associated with information are reassigned only via re-grading mechanisms validated using _[Assignment: organization-defined techniques or procedures]_.
AC-16 (10):
  name: Attribute Configuration by Authorized Individuals
  family: Access Control
  description: |
    The information system provides authorized individuals the capability to define or change the type and value of security attributes available for association with subjects and objects.
AC-17:
  name: Remote Access
  family: Access Control
  description: |
    The organization:
      - **AC-17a.** Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
      - **AC-17b.** Authorizes remote access to the information system prior to allowing such connections.
AC-17 (1):
  name: Automated Monitoring / Control
  family: Access Control
  description: |
    The information system monitors and controls remote access methods.
AC-17 (2):
  name: Protection of Confidentiality / Integrity Using Encryption
  family: Access Control
  description: |
    The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
AC-17 (3):
  name: Managed Access Control Points
  family: Access Control
  description: |
    The information system routes all remote accesses through _[Assignment: organization-defined number]_ managed network access control points.
AC-17 (4):
  name: Privileged Commands / Access
  family: Access Control
  description: |
    The organization:
      - **AC-17 (4)(a)** Authorizes the execution of privileged commands and access to security-relevant information via remote access only for _[Assignment: organization-defined needs]_; and
      - **AC-17 (4)(b)** Documents the rationale for such access in the security plan for the information system.
AC-17 (5):
  name: Monitoring for Unauthorized Connections
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into SI-4]_.
AC-17 (6):
  name: Protection of Information
  family: Access Control
  description: |
    The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.
AC-17 (7):
  name: Additional Protection for Security Function Access
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into AC-3 (10)]_.
AC-17 (8):
  name: Disable Nonsecure Network Protocols
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into CM-7]_.
AC-17 (9):
  name: Disconnect / Disable Access
  family: Access Control
  description: |
    The organization provides the capability to expeditiously disconnect or disable remote access to the information system within _[Assignment: organization-defined time period]_.
AC-18:
  name: Wireless Access
  family: Access Control
  description: |
    The organization:
      - **AC-18a.** Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
      - **AC-18b.** Authorizes wireless access to the information system prior to allowing such connections.
AC-18 (1):
  name: Authentication and Encryption
  family: Access Control
  description: |
    The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
AC-18 (2):
  name: Monitoring Unauthorized Connections
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into SI-4]_.
AC-18 (3):
  name: Disable Wireless Networking
  family: Access Control
  description: |
    The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
AC-18 (4):
  name: Restrict Configurations by Users
  family: Access Control
  description: |
    The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.
AC-18 (5):
  name: Antennas / Transmission Power Levels
  family: Access Control
  description: |
    The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.
AC-19:
  name: Access Control for Mobile Devices
  family: Access Control
  description: |
    The organization:
      - **AC-19a.** Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and
      - **AC-19b.** Authorizes the connection of mobile devices to organizational information systems.
AC-19 (1):
  name: Use of  Writable / Portable Storage Devices
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into MP-7]_.
AC-19 (2):
  name: Use of Personally Owned Portable Storage Devices
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into MP-7]_.
AC-19 (3):
  name: Use of Portable Storage Devices With No Identifiable Owner
  family: Access Control
  description: |
    _[Withdrawn: Incorporated into MP-7]_.
AC-19 (4):
  name: Restrictions for Classified Information
  family: Access Control
  description: |
    The organization:
      - **AC-19 (4)(a)** Prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and
      - **AC-19 (4)(b)** Enforces the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information:
        - **AC-19 (4)(b)(1)** Connection of unclassified mobile devices to classified information systems is prohibited;
        - **AC-19 (4)(b)(2)** Connection of unclassified mobile devices to unclassified information systems requires approval from the authorizing official;
        - **AC-19 (4)(b)(3)** Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and
        - **AC-19 (4)(b)(4)** Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by _[Assignment: organization-defined security officials]_, and if classified information is found, the incident handling policy is followed.
      - **AC-19 (4)(c)** Restricts the connection of classified mobile devices to classified information systems in accordance with _[Assignment: organization-defined security policies]_.
AC-19 (5):
  name: Full Device / Container-based  Encryption
  family: Access Control
  description: |
    The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on _[Assignment: organization-defined mobile devices]_.
AC-20:
  name: Use of External Information Systems
  family: Access Control
  description: |
    The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:
      - **AC-20a.** Access the information system from external information systems; and
      - **AC-20b.** Process, store, or transmit organization-controlled information using external information systems.
AC-20 (1):
  name: Limits on Authorized Use
  family: Access Control
  description: |
    The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:
      - **AC-20 (1)(a)** Verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan; or
      - **AC-20 (1)(b)** Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.
AC-20 (2):
  name: Portable Storage Devices
  family: Access Control
  description: |
    The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.
AC-20 (3):
  name: Non-organizationally Owned Systems / Components / Devices
  family: Access Control
  description: |
    The organization [Selection: restricts; prohibits] the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.
AC-20 (4):
  name: Network Accessible Storage Devices
  family: Access Control
  description: |
    The organization prohibits the use of _[Assignment: organization-defined network accessible storage devices]_ in external information systems.
AC-21:
  name: Information Sharing
  family: Access Control
  description: |
    The organization:
      - **AC-21a.** Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for _[Assignment: organization-defined information sharing circumstances where user discretion is required]_; and
      - **AC-21b.** Employs _[Assignment: organization-defined automated mechanisms or manual processes]_ to assist users in making information sharing/collaboration decisions.
AC-21 (1):
  name: Automated Decision Support
  family: Access Control
  description: |
    The information system enforces information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
AC-21 (2):
  name: Information Search and Retrieval
  family: Access Control
  description: |
    The information system implements information search and retrieval services that enforce _[Assignment: organization-defined information sharing restrictions]_.
AC-22:
  name: Publicly Accessible Content
  family: Access Control
  description: |
    The organization:
      - **AC-22a.** Designates individuals authorized to post information onto a publicly accessible information system;
      - **AC-22b.** Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
      - **AC-22c.** Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and
      - **AC-22d.** Reviews the content on the publicly accessible information system for nonpublic information _[Assignment: organization-defined frequency]_ and removes such information, if discovered.
AC-23:
  name: Data Mining Protection
  family: Access Control
  description: |
    The organization employs _[Assignment: organization-defined data mining prevention and detection techniques]_ for _[Assignment: organization-defined data storage objects]_ to adequately detect and protect against data mining.
AC-24:
  name: Access Control Decisions
  family: Access Control
  description: |
    The organization establishes procedures to ensure _[Assignment: organization-defined access control decisions]_ are applied to each access request prior to access enforcement.
AC-24 (1):
  name: Transmit Access Authorization Information
  family: Access Control
  description: |
    The information system transmits _[Assignment: organization-defined access authorization information]_ using _[Assignment: organization-defined security safeguards]_ to _[Assignment: organization-defined information systems]_ that enforce access control decisions.
AC-24 (2):
  name: No User or Process Identity
  family: Access Control
  description: |
    The information system enforces access control decisions based on _[Assignment: organization-defined security attributes]_ that do not include the identity of the user or process acting on behalf of the user.
AC-25:
  name: Reference Monitor
  family: Access Control
  description: |
    The information system implements a reference monitor for _[Assignment: organization-defined access control policies]_ that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
AT-1:
  name: Security Awareness and Training Policy and Procedures
  family: Awareness and Training
  description: |
    The organization:
      - **AT-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **AT-1a.1.** A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **AT-1a.2.** Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and
      - **AT-1b.** Reviews and updates the current:
        - **AT-1b.1.** Security awareness and training policy _[Assignment: organization-defined frequency]_; and
        - **AT-1b.2.** Security awareness and training procedures _[Assignment: organization-defined frequency]_.
AT-2:
  name: Security Awareness Training
  family: Awareness and Training
  description: |
    The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):
      - **AT-2a.** As part of initial training for new users;
      - **AT-2b.** When required by information system changes; and
      - **AT-2c.** _[Assignment: organization-defined frequency]_ thereafter.
AT-2 (1):
  name: Practical Exercises
  family: Awareness and Training
  description: |
    The organization includes practical exercises in security awareness training that simulate actual cyber attacks.
AT-2 (2):
  name: Insider Threat
  family: Awareness and Training
  description: |
    The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
AT-3:
  name: Role-based Security Training
  family: Awareness and Training
  description: |
    The organization provides role-based security training to personnel with assigned security roles and responsibilities:
      - **AT-3a.** Before authorizing access to the information system or performing assigned duties;
      - **AT-3b.** When required by information system changes; and
      - **AT-3c.** _[Assignment: organization-defined frequency]_ thereafter.
AT-3 (1):
  name: Environmental Controls
  family: Awareness and Training
  description: |
    The organization provides _[Assignment: organization-defined personnel or roles]_ with initial and _[Assignment: organization-defined frequency]_ training in the employment and operation of environmental controls.
AT-3 (2):
  name: Physical Security Controls
  family: Awareness and Training
  description: |
    The organization provides _[Assignment: organization-defined personnel or roles]_ with initial and _[Assignment: organization-defined frequency]_ training in the employment and operation of physical security controls.
AT-3 (3):
  name: Practical Exercises
  family: Awareness and Training
  description: |
    The organization includes practical exercises in security training that reinforce training objectives.
AT-3 (4):
  name: Suspicious Communications and Anomalous System Behavior
  family: Awareness and Training
  description: |
    The organization provides training to its personnel on _[Assignment: organization-defined indicators of malicious code]_ to recognize suspicious communications and anomalous behavior in organizational information systems.
AT-4:
  name: Security Training Records
  family: Awareness and Training
  description: |
    The organization:
      - **AT-4a.** Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and
      - **AT-4b.** Retains individual training records for _[Assignment: organization-defined time period]_.
AT-5:
  name: Contacts With Security Groups and Associations
  family: Awareness and Training
  description: |
    _[Withdrawn: Incorporated into PM-15]_.
AU-1:
  name: Audit and Accountability Policy and Procedures
  family: Audit and Accountability
  description: |
    The organization:
      - **AU-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **AU-1a.1.** An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **AU-1a.2.** Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and
      - **AU-1b.** Reviews and updates the current:
        - **AU-1b.1.** Audit and accountability policy _[Assignment: organization-defined frequency]_; and
        - **AU-1b.2.** Audit and accountability procedures _[Assignment: organization-defined frequency]_.
AU-2:
  name: Audit Events
  family: Audit and Accountability
  description: |
    The organization:
      - **AU-2a.** Determines that the information system is capable of auditing the following events: _[Assignment: organization-defined auditable events]_;
      - **AU-2b.** Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events;
      - **AU-2c.** Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and
      - **AU-2d.** Determines that the following events are to be audited within the information system: _[Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event]_.
AU-2 (1):
  name: Compilation of Audit Records From Multiple Sources
  family: Audit and Accountability
  description: |
    _[Withdrawn: Incorporated into AU-12]_.
AU-2 (2):
  name: Selection of Audit Events by Component
  family: Audit and Accountability
  description: |
    _[Withdrawn: Incorporated into AU-12]_.
AU-2 (3):
  name: Reviews and Updates
  family: Audit and Accountability
  description: |
    The organization reviews and updates the audited events _[Assignment: organization-defined frequency]_.
AU-2 (4):
  name: Privileged Functions
  family: Audit and Accountability
  description: |
    _[Withdrawn: Incorporated into AC-6 (9)]_.
AU-3:
  name: Content of Audit Records
  family: Audit and Accountability
  description: |
    The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
AU-3 (1):
  name: Additional Audit Information
  family: Audit and Accountability
  description: |
    The information system generates audit records containing the following additional information: _[Assignment: organization-defined additional, more detailed information]_.
AU-3 (2):
  name: Centralized Management of Planned Audit Record Content
  family: Audit and Accountability
  description: |
    The information system provides centralized management and configuration of the content to be captured in audit records generated by _[Assignment: organization-defined information system components]_.
AU-4:
  name: Audit Storage Capacity
  family: Audit and Accountability
  description: |
    The organization allocates audit record storage capacity in accordance with _[Assignment: organization-defined audit record storage requirements]_.
AU-4 (1):
  name: Transfer to Alternate Storage
  family: Audit and Accountability
  description: |
    The information system off-loads audit records _[Assignment: organization-defined frequency]_ onto a different system or media than the system being audited.
AU-5:
  name: Response to Audit Processing Failures
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-5a.** Alerts _[Assignment: organization-defined personnel or roles]_ in the event of an audit processing failure; and
      - **AU-5b.** Takes the following additional actions: _[Assignment: organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)]_.
AU-5 (1):
  name: Audit Storage Capacity
  family: Audit and Accountability
  description: |
    The information system provides a warning to _[Assignment: organization-defined personnel, roles, and/or locations]_ within _[Assignment: organization-defined time period]_ when allocated audit record storage volume reaches _[Assignment: organization-defined percentage]_ of repository maximum audit record storage capacity.
AU-5 (2):
  name: Real-time Alerts
  family: Audit and Accountability
  description: |
    The information system provides an alert in _[Assignment: organization-defined real-time period]_ to _[Assignment: organization-defined personnel, roles, and/or locations]_ when the following audit failure events occur: _[Assignment: organization-defined audit failure events requiring real-time alerts]_.
AU-5 (3):
  name: Configurable Traffic Volume Thresholds
  family: Audit and Accountability
  description: |
    The information system enforces configurable network communications traffic volume thresholds reflecting limits on auditing capacity and [Selection: rejects; delays] network traffic above those thresholds.
AU-5 (4):
  name: Shutdown on Failure
  family: Audit and Accountability
  description: |
    The information system invokes a [Selection: full system shutdown; partial system shutdown; degraded operational mode with limited mission/business functionality available] in the event of _[Assignment: organization-defined audit failures]_, unless an alternate audit capability exists.
AU-6:
  name: Audit Review, Analysis, and Reporting
  family: Audit and Accountability
  description: |
    The organization:
      - **AU-6a.** Reviews and analyzes information system audit records _[Assignment: organization-defined frequency]_ for indications of _[Assignment: organization-defined inappropriate or unusual activity]_; and
      - **AU-6b.** Reports findings to _[Assignment: organization-defined personnel or roles]_.
AU-6 (1):
  name: Process Integration
  family: Audit and Accountability
  description: |
    The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
AU-6 (2):
  name: Automated Security Alerts
  family: Audit and Accountability
  description: |
    _[Withdrawn: Incorporated into SI-4]_.
AU-6 (3):
  name: Correlate Audit Repositories
  family: Audit and Accountability
  description: |
    The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
AU-6 (4):
  name: Central Review and Analysis
  family: Audit and Accountability
  description: |
    The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
AU-6 (5):
  name: Integration / Scanning and Monitoring Capabilities
  family: Audit and Accountability
  description: |
    The organization integrates analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; information system monitoring information; _[Assignment: organization-defined data/information collected from other sources]_] to further enhance the ability to identify inappropriate or unusual activity.
AU-6 (6):
  name: Correlation With Physical Monitoring
  family: Audit and Accountability
  description: |
    The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
AU-6 (7):
  name: Permitted Actions
  family: Audit and Accountability
  description: |
    The organization specifies the permitted actions for each [Selection (one or more): information system process; role; user] associated with the review, analysis, and reporting of audit information.
AU-6 (8):
  name: Full Text Analysis of Privileged Commands
  family: Audit and Accountability
  description: |
    The organization performs a full text analysis of audited privileged commands in a physically distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.
AU-6 (9):
  name: Correlation With Information From Nontechnical Sources
  family: Audit and Accountability
  description: |
    The organization correlates information from nontechnical sources with audit information to enhance organization-wide situational awareness.
AU-6 (10):
  name: Audit Level Adjustment
  family: Audit and Accountability
  description: |
    The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
AU-7:
  name: Audit Reduction and Report Generation
  family: Audit and Accountability
  description: |
    The information system provides an audit reduction and report generation capability that:
      - **AU-7a.** Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and
      - **AU-7b.** Does not alter the original content or time ordering of audit records.
AU-7 (1):
  name: Automatic Processing
  family: Audit and Accountability
  description: |
    The information system provides the capability to process audit records for events of interest based on _[Assignment: organization-defined audit fields within audit records]_.
AU-7 (2):
  name: Automatic Sort and Search
  family: Audit and Accountability
  description: |
    The information system provides the capability to sort and search audit records for events of interest based on the content of _[Assignment: organization-defined audit fields within audit records]_.
AU-8:
  name: Time Stamps
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-8a.** Uses internal system clocks to generate time stamps for audit records; and
      - **AU-8b.** Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets _[Assignment: organization-defined granularity of time measurement]_.
AU-8 (1):
  name: Synchronization With Authoritative Time Source
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-8 (1)(a)** Compares the internal information system clocks _[Assignment: organization-defined frequency]_ with _[Assignment: organization-defined authoritative time source]_; and
      - **AU-8 (1)(b)** Synchronizes the internal system clocks to the authoritative time source when the time difference is greater than _[Assignment: organization-defined time period]_.
AU-8 (2):
  name: Secondary Authoritative Time Source
  family: Audit and Accountability
  description: |
    The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.
AU-9:
  name: Protection of Audit Information
  family: Audit and Accountability
  description: |
    The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
AU-9 (1):
  name: Hardware Write-once Media
  family: Audit and Accountability
  description: |
    The information system writes audit trails to hardware-enforced, write-once media.
AU-9 (2):
  name: Audit Backup on Separate Physical Systems / Components
  family: Audit and Accountability
  description: |
    The information system backs up audit records _[Assignment: organization-defined frequency]_ onto a physically different system or system component than the system or component being audited.
AU-9 (3):
  name: Cryptographic Protection
  family: Audit and Accountability
  description: |
    The information system implements cryptographic mechanisms to protect the integrity of audit information and audit tools.
AU-9 (4):
  name: Access by Subset of Privileged Users
  family: Audit and Accountability
  description: |
    The organization authorizes access to management of audit functionality to only _[Assignment: organization-defined subset of privileged users]_.
AU-9 (5):
  name: Dual Authorization
  family: Audit and Accountability
  description: |
    The organization enforces dual authorization for [Selection (one or more): movement; deletion] of _[Assignment: organization-defined audit information]_.
AU-9 (6):
  name: Read Only Access
  family: Audit and Accountability
  description: |
    The organization authorizes read-only access to audit information to _[Assignment: organization-defined subset of privileged users]_.
AU-10:
  name: Non-repudiation
  family: Audit and Accountability
  description: |
    The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed _[Assignment: organization-defined actions to be covered by non-repudiation]_.
AU-10 (1):
  name: Association of Identities
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-10 (1)(a)** Binds the identity of the information producer with the information to _[Assignment: organization-defined strength of binding]_; and
      - **AU-10 (1)(b)** Provides the means for authorized individuals to determine the identity of the producer of the information.
AU-10 (2):
  name: Validate Binding of Information Producer Identity
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-10 (2)(a)** Validates the binding of the information producer identity to the information at _[Assignment: organization-defined frequency]_; and
      - **AU-10 (2)(b)** Performs _[Assignment: organization-defined actions]_ in the event of a validation error.
AU-10 (3):
  name: Chain of Custody
  family: Audit and Accountability
  description: |
    The information system maintains reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.
AU-10 (4):
  name: Validate Binding of Information Reviewer Identity
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-10 (4)(a)** Validates the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer between _[Assignment: organization-defined security domains]_; and
      - **AU-10 (4)(b)** Performs _[Assignment: organization-defined actions]_ in the event of a validation error.
AU-10 (5):
  name: Digital Signatures
  family: Audit and Accountability
  description: |
    _[Withdrawn: Incorporated into SI-7]_.
AU-11:
  name: Audit Record Retention
  family: Audit and Accountability
  description: |
    The organization retains audit records for _[Assignment: organization-defined time period consistent with records retention policy]_ to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
AU-11 (1):
  name: Long-term Retrieval Capability
  family: Audit and Accountability
  description: |
    The organization employs _[Assignment: organization-defined measures]_ to ensure that long-term audit records generated by the information system can be retrieved.
AU-12:
  name: Audit Generation
  family: Audit and Accountability
  description: |
    The information system:
      - **AU-12a.** Provides audit record generation capability for the auditable events defined in AU-2 a. at _[Assignment: organization-defined information system components]_;
      - **AU-12b.** Allows _[Assignment: organization-defined personnel or roles]_ to select which auditable events are to be audited by specific components of the information system; and
      - **AU-12c.** Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
AU-12 (1):
  name: System-wide / Time-correlated Audit Trail
  family: Audit and Accountability
  description: |
    The information system compiles audit records from _[Assignment: organization-defined information system components]_ into a system-wide (logical or physical) audit trail that is time-correlated to within _[Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail]_.
AU-12 (2):
  name: Standardized Formats
  family: Audit and Accountability
  description: |
    The information system produces a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
AU-12 (3):
  name: Changes by Authorized Individuals
  family: Audit and Accountability
  description: |
    The information system provides the capability for _[Assignment: organization-defined individuals or roles]_ to change the auditing to be performed on _[Assignment: organization-defined information system components]_ based on _[Assignment: organization-defined selectable event criteria]_ within _[Assignment: organization-defined time thresholds]_.
AU-13:
  name: Monitoring for Information Disclosure
  family: Audit and Accountability
  description: |
    The organization monitors _[Assignment: organization-defined open source information and/or information sites]_ _[Assignment: organization-defined frequency]_ for evidence of unauthorized disclosure of organizational information.
AU-13 (1):
  name: Use of Automated Tools
  family: Audit and Accountability
  description: |
    The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.
AU-13 (2):
  name: Review of Monitored Sites
  family: Audit and Accountability
  description: |
    The organization reviews the open source information sites being monitored _[Assignment: organization-defined frequency]_.
AU-14:
  name: Session Audit
  family: Audit and Accountability
  description: |
    The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
AU-14 (1):
  name: System Start-up
  family: Audit and Accountability
  description: |
    The information system initiates session audits at system start-up.
AU-14 (2):
  name: Capture/record and Log Content
  family: Audit and Accountability
  description: |
    The information system provides the capability for authorized users to capture/record and log content related to a user session.
AU-14 (3):
  name: Remote Viewing / Listening
  family: Audit and Accountability
  description: |
    The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.
AU-15:
  name: Alternate Audit Capability
  family: Audit and Accountability
  description: |
    The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides _[Assignment: organization-defined alternate audit functionality]_.
AU-16:
  name: Cross-organizational Auditing
  family: Audit and Accountability
  description: |
    The organization employs _[Assignment: organization-defined methods]_ for coordinating _[Assignment: organization-defined audit information]_ among external organizations when audit information is transmitted across organizational boundaries.
AU-16 (1):
  name: Identity Preservation
  family: Audit and Accountability
  description: |
    The organization requires that the identity of individuals be preserved in cross-organizational audit trails.
AU-16 (2):
  name: Sharing of Audit Information
  family: Audit and Accountability
  description: |
    The organization provides cross-organizational audit information to _[Assignment: organization-defined organizations]_ based on _[Assignment: organization-defined cross-organizational sharing agreements]_.
CA-1:
  name: Security Assessment and Authorization Policy and Procedures
  family: Security Assessment and Authorization
  description: |
    The organization:
      - **CA-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **CA-1a.1.** A security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **CA-1a.2.** Procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls; and
      - **CA-1b.** Reviews and updates the current:
        - **CA-1b.1.** Security assessment and authorization policy _[Assignment: organization-defined frequency]_; and
        - **CA-1b.2.** Security assessment and authorization procedures _[Assignment: organization-defined frequency]_.
CA-2:
  name: Security Assessments
  family: Security Assessment and Authorization
  description: |
    The organization:
      - **CA-2a.** Develops a security assessment plan that describes the scope of the assessment including:
        - **CA-2a.1.** Security controls and control enhancements under assessment;
        - **CA-2a.2.** Assessment procedures to be used to determine security control effectiveness; and
        - **CA-2a.3.** Assessment environment, assessment team, and assessment roles and responsibilities;
      - **CA-2b.** Assesses the security controls in the information system and its environment of operation _[Assignment: organization-defined frequency]_ to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
      - **CA-2c.** Produces a security assessment report that documents the results of the assessment; and
      - **CA-2d.** Provides the results of the security control assessment to _[Assignment: organization-defined individuals or roles]_.
CA-2 (1):
  name: Independent Assessors
  family: Security Assessment and Authorization
  description: |
    The organization employs assessors or assessment teams with _[Assignment: organization-defined level of independence]_ to conduct security control assessments.
CA-2 (2):
  name: Specialized Assessments
  family: Security Assessment and Authorization
  description: |
    The organization includes as part of security control assessments, _[Assignment: organization-defined frequency]_, [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; _[Assignment: organization-defined other forms of security assessment]_].
CA-2 (3):
  name: External Organizations
  family: Security Assessment and Authorization
  description: |
    The organization accepts the results of an assessment of _[Assignment: organization-defined information system]_ performed by _[Assignment: organization-defined external organization]_ when the assessment meets _[Assignment: organization-defined requirements]_.
CA-3:
  name: System Interconnections
  family: Security Assessment and Authorization
  description: |
    The organization:
      - **CA-3a.** Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements;
      - **CA-3b.** Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and
      - **CA-3c.** Reviews and updates Interconnection Security Agreements _[Assignment: organization-defined frequency]_.
CA-3 (1):
  name: Unclassified National Security System Connections
  family: Security Assessment and Authorization
  description: |
    The organization prohibits the direct connection of an _[Assignment: organization-defined unclassified, national security system]_ to an external network without the use of _[Assignment: organization-defined boundary protection device]_.
CA-3 (2):
  name: Classified National Security System Connections
  family: Security Assessment and Authorization
  description: |
    The organization prohibits the direct connection of a classified, national security system to an external network without the use of _[Assignment: organization-defined boundary protection device]_.
CA-3 (3):
  name: Unclassified Non-national Security System Connections
  family: Security Assessment and Authorization
  description: |
    The organization prohibits the direct connection of an _[Assignment: organization-defined unclassified, non-national security system]_ to an external network without the use of [Assignment; organization-defined boundary protection device].
CA-3 (4):
  name: Connections to Public Networks
  family: Security Assessment and Authorization
  description: |
    The organization prohibits the direct connection of an _[Assignment: organization-defined information system]_ to a public network.
CA-3 (5):
  name: Restrictions on External System Connections
  family: Security Assessment and Authorization
  description: |
    The organization employs [Selection: allow-all, deny-by-exception; deny-all, permit-by-exception] policy for allowing _[Assignment: organization-defined information systems]_ to connect to external information systems.
CA-4:
  name: Security Certification
  family: Security Assessment and Authorization
  description: |
    _[Withdrawn: Incorporated into CA-2]_.
CA-5:
  name: Plan of Action and Milestones
  family: Security Assessment and Authorization
  description: |
    The organization:
      - **CA-5a.** Develops a plan of action and milestones for the information system to document the organization's planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and
      - **CA-5b.** Updates existing plan of action and milestones _[Assignment: organization-defined frequency]_ based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.
CA-5 (1):
  name: Automation Support for Accuracy / Currency
  family: Security Assessment and Authorization
  description: |
    The organization employs automated mechanisms to help ensure that the plan of action and milestones for the information system is accurate, up to date, and readily available.
CA-6:
  name: Security Authorization
  family: Security Assessment and Authorization
  description: |
    The organization:
      - **CA-6a.** Assigns a senior-level executive or manager as the authorizing official for the information system;
      - **CA-6b.** Ensures that the authorizing official authorizes the information system for processing before commencing operations; and
      - **CA-6c.** Updates the security authorization _[Assignment: organization-defined frequency]_.
CA-7:
  name: Continuous Monitoring
  family: Security Assessment and Authorization
  description: |
    The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:
      - **CA-7a.** Establishment of _[Assignment: organization-defined metrics]_ to be monitored;
      - **CA-7b.** Establishment of _[Assignment: organization-defined frequencies]_ for monitoring and _[Assignment: organization-defined frequencies]_ for assessments supporting such monitoring;
      - **CA-7c.** Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;
      - **CA-7d.** Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;
      - **CA-7e.** Correlation and analysis of security-related information generated by assessments and monitoring;
      - **CA-7f.** Response actions to address results of the analysis of security-related information; and
      - **CA-7g.** Reporting the security status of organization and the information system to _[Assignment: organization-defined personnel or roles]_ _[Assignment: organization-defined frequency]_.
CA-7 (1):
  name: Independent Assessment
  family: Security Assessment and Authorization
  description: |
    The organization employs assessors or assessment teams with _[Assignment: organization-defined level of independence]_ to monitor the security controls in the information system on an ongoing basis.
CA-7 (2):
  name: Types of Assessments
  family: Security Assessment and Authorization
  description: |
    _[Withdrawn: Incorporated into CA-2]_.
CA-7 (3):
  name: Trend Analyses
  family: Security Assessment and Authorization
  description: |
    The organization employs trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data.
CA-8:
  name: Penetration Testing
  family: Security Assessment and Authorization
  description: |
    The organization conducts penetration testing _[Assignment: organization-defined frequency]_ on _[Assignment: organization-defined information systems or system components]_.
CA-8 (1):
  name: Independent Penetration Agent or Team
  family: Security Assessment and Authorization
  description: |
    The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.
CA-8 (2):
  name: Red Team Exercises
  family: Security Assessment and Authorization
  description: |
    The organization employs _[Assignment: organization-defined red team exercises]_ to simulate attempts by adversaries to compromise organizational information systems in accordance with _[Assignment: organization-defined rules of engagement]_.
CA-9:
  name: Internal System Connections
  family: Security Assessment and Authorization
  description: |
    The organization:
      - **CA-9a.** Authorizes internal connections of _[Assignment: organization-defined information system components or classes of components]_ to the information system; and
      - **CA-9b.** Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.
CA-9 (1):
  name: Security Compliance Checks
  family: Security Assessment and Authorization
  description: |
    The information system performs security compliance checks on constituent system components prior to the establishment of the internal connection.
CM-1:
  name: Configuration Management Policy and Procedures
  family: Configuration Management
  description: |
    The organization:
      - **CM-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **CM-1a.1.** A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **CM-1a.2.** Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and
      - **CM-1b.** Reviews and updates the current:
        - **CM-1b.1.** Configuration management policy _[Assignment: organization-defined frequency]_; and
        - **CM-1b.2.** Configuration management procedures _[Assignment: organization-defined frequency]_.
CM-2:
  name: Baseline Configuration
  family: Configuration Management
  description: |
    The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
CM-2 (1):
  name: Reviews and Updates
  family: Configuration Management
  description: |
    The organization reviews and updates the baseline configuration of the information system:
      - **CM-2 (1)(a)** _[Assignment: organization-defined frequency]_;
      - **CM-2 (1)(b)** When required due to [Assignment organization-defined circumstances]; and
      - **CM-2 (1)(c)** As an integral part of information system component installations and upgrades.
CM-2 (2):
  name: Automation Support for Accuracy / Currency
  family: Configuration Management
  description: |
    The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.
CM-2 (3):
  name: Retention of Previous Configurations
  family: Configuration Management
  description: |
    The organization retains _[Assignment: organization-defined previous versions of baseline configurations of the information system]_ to support rollback.
CM-2 (4):
  name: Unauthorized Software
  family: Configuration Management
  description: |
    _[Withdrawn: Incorporated into CM-7]_.
CM-2 (5):
  name: Authorized Software
  family: Configuration Management
  description: |
    _[Withdrawn: Incorporated into CM-7]_.
CM-2 (6):
  name: Development and Test Environments
  family: Configuration Management
  description: |
    The organization maintains a baseline configuration for information system development and test environments that is managed separately from the operational baseline configuration.
CM-2 (7):
  name: Configure Systems, Components, or Devices for High-risk Areas
  family: Configuration Management
  description: |
    The organization:
      - **CM-2 (7)(a)** Issues _[Assignment: organization-defined information systems, system components, or devices]_ with _[Assignment: organization-defined configurations]_ to individuals traveling to locations that the organization deems to be of significant risk; and
      - **CM-2 (7)(b)** Applies _[Assignment: organization-defined security safeguards]_ to the devices when the individuals return.
CM-3:
  name: Configuration Change Control
  family: Configuration Management
  description: |
    The organization:
      - **CM-3a.** Determines the types of changes to the information system that are configuration-controlled;
      - **CM-3b.** Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;
      - **CM-3c.** Documents configuration change decisions associated with the information system;
      - **CM-3d.** Implements approved configuration-controlled changes to the information system;
      - **CM-3e.** Retains records of configuration-controlled changes to the information system for _[Assignment: organization-defined time period]_;
      - **CM-3f.** Audits and reviews activities associated with configuration-controlled changes to the information system; and
      - **CM-3g.** Coordinates and provides oversight for configuration change control activities through _[Assignment: organization-defined configuration change control element (e.g., committee, board)]_ that convenes [Selection (one or more): _[Assignment: organization-defined frequency]_; _[Assignment: organization-defined configuration change conditions]_].
CM-3 (1):
  name: Automated Document / Notification / Prohibition of Changes
  family: Configuration Management
  description: |
    The organization employs automated mechanisms to:
      - **CM-3 (1)(a)** Document proposed changes to the information system;
      - **CM-3 (1)(b)** Notify _[Assignment: organized-defined approval authorities]_ of proposed changes to the information system and request change approval;
      - **CM-3 (1)(c)** Highlight proposed changes to the information system that have not been approved or disapproved by _[Assignment: organization-defined time period]_;
      - **CM-3 (1)(d)** Prohibit changes to the information system until designated approvals are received;
      - **CM-3 (1)(e)** Document all changes to the information system; and
      - **CM-3 (1)(f)** Notify _[Assignment: organization-defined personnel]_ when approved changes to the information system are completed.
CM-3 (2):
  name: Test / Validate / Document Changes
  family: Configuration Management
  description: |
    The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.
CM-3 (3):
  name: Automated Change Implementation
  family: Configuration Management
  description: |
    The organization employs automated mechanisms to implement changes to the current information system baseline and deploys the updated baseline across the installed base.
CM-3 (4):
  name: Security Representative
  family: Configuration Management
  description: |
    The organization requires an information security representative to be a member of the _[Assignment: organization-defined configuration change control element]_.
CM-3 (5):
  name: Automated Security Response
  family: Configuration Management
  description: |
    The information system implements _[Assignment: organization-defined security responses]_ automatically if baseline configurations are changed in an unauthorized manner.
CM-3 (6):
  name: Cryptography Management
  family: Configuration Management
  description: |
    The organization ensures that cryptographic mechanisms used to provide _[Assignment: organization-defined security safeguards]_ are under configuration management.
CM-4:
  name: Security Impact Analysis
  family: Configuration Management
  description: |
    The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
CM-4 (1):
  name: Separate Test Environments
  family: Configuration Management
  description: |
    The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CM-4 (2):
  name: Verification of Security Functions
  family: Configuration Management
  description: |
    The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security requirements for the system.
CM-5:
  name: Access Restrictions for Change
  family: Configuration Management
  description: |
    The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
CM-5 (1):
  name: Automated Access Enforcement / Auditing
  family: Configuration Management
  description: |
    The information system enforces access restrictions and supports auditing of the enforcement actions.
CM-5 (2):
  name: Review System Changes
  family: Configuration Management
  description: |
    The organization reviews information system changes _[Assignment: organization-defined frequency]_ and _[Assignment: organization-defined circumstances]_ to determine whether unauthorized changes have occurred.
CM-5 (3):
  name: Signed Components
  family: Configuration Management
  description: |
    The information system prevents the installation of _[Assignment: organization-defined software and firmware components]_ without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
CM-5 (4):
  name: Dual Authorization
  family: Configuration Management
  description: |
    The organization enforces dual authorization for implementing changes to _[Assignment: organization-defined information system components and system-level information]_.
CM-5 (5):
  name: Limit Production / Operational Privileges
  family: Configuration Management
  description: |
    The organization:
      - **CM-5 (5)(a)** Limits privileges to change information system components and system-related information within a production or operational environment; and
      - **CM-5 (5)(b)** Reviews and reevaluates privileges _[Assignment: organization-defined frequency]_.
CM-5 (6):
  name: Limit Library Privileges
  family: Configuration Management
  description: |
    The organization limits privileges to change software resident within software libraries.
CM-5 (7):
  name: Automatic Implementation of Security Safeguards
  family: Configuration Management
  description: |
    _[Withdrawn: Incorporated into SI-7]_.
CM-6:
  name: Configuration Settings
  family: Configuration Management
  description: |
    The organization:
      - **CM-6a.** Establishes and documents configuration settings for information technology products employed within the information system using _[Assignment: organization-defined security configuration checklists]_ that reflect the most restrictive mode consistent with operational requirements;
      - **CM-6b.** Implements the configuration settings;
      - **CM-6c.** Identifies, documents, and approves any deviations from established configuration settings for _[Assignment: organization-defined information system components]_ based on _[Assignment: organization-defined operational requirements]_; and
      - **CM-6d.** Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
CM-6 (1):
  name: Automated Central Management / Application / Verification
  family: Configuration Management
  description: |
    The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for _[Assignment: organization-defined information system components]_.
CM-6 (2):
  name: Respond to Unauthorized Changes
  family: Configuration Management
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to respond to unauthorized changes to _[Assignment: organization-defined configuration settings]_.
CM-6 (3):
  name: Unauthorized Change Detection
  family: Configuration Management
  description: |
    _[Withdrawn: Incorporated into SI-7]_.
CM-6 (4):
  name: Conformance Demonstration
  family: Configuration Management
  description: |
    _[Withdrawn: Incorporated into CM-4]_.
CM-7:
  name: Least Functionality
  family: Configuration Management
  description: |
    The organization:
      - **CM-7a.** Configures the information system to provide only essential capabilities; and
      - **CM-7b.** Prohibits or restricts the use of the following functions, ports, protocols, and/or services: _[Assignment: organization-defined prohibited or restricted functions, ports, protocols, and/or services]_.
CM-7 (1):
  name: Periodic Review
  family: Configuration Management
  description: |
    The organization:
      - **CM-7 (1)(a)** Reviews the information system _[Assignment: organization-defined frequency]_ to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and
      - **CM-7 (1)(b)** Disables _[Assignment: organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure]_.
CM-7 (2):
  name: Prevent Program Execution
  family: Configuration Management
  description: |
    The information system prevents program execution in accordance with [Selection (one or more): _[Assignment: organization-defined policies regarding software program usage and restrictions]_; rules authorizing the terms and conditions of software program usage].
CM-7 (3):
  name: Registration Compliance
  family: Configuration Management
  description: |
    The organization ensures compliance with _[Assignment: organization-defined registration requirements for functions, ports, protocols, and services]_.
CM-7 (4):
  name: Unauthorized Software / Blacklisting
  family: Configuration Management
  description: |
    The organization:
      - **CM-7 (4)(a)** Identifies _[Assignment: organization-defined software programs not authorized to execute on the information system]_;
      - **CM-7 (4)(b)** Employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system; and
      - **CM-7 (4)(c)** Reviews and updates the list of unauthorized software programs _[Assignment: organization-defined frequency]_.
CM-7 (5):
  name: Authorized Software / Whitelisting
  family: Configuration Management
  description: |
    The organization:
      - **CM-7 (5)(a)** Identifies _[Assignment: organization-defined software programs authorized to execute on the information system]_;
      - **CM-7 (5)(b)** Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and
      - **CM-7 (5)(c)** Reviews and updates the list of authorized software programs _[Assignment: organization-defined frequency]_.
CM-8:
  name: Information System Component Inventory
  family: Configuration Management
  description: |
    The organization:
      - **CM-8a.** Develops and documents an inventory of information system components that:
        - **CM-8a.1.** Accurately reflects the current information system;
        - **CM-8a.2.** Includes all components within the authorization boundary of the information system;
        - **CM-8a.3.** Is at the level of granularity deemed necessary for tracking and reporting; and
        - **CM-8a.4.** Includes _[Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]_; and
      - **CM-8b.** Reviews and updates the information system component inventory _[Assignment: organization-defined frequency]_.
CM-8 (1):
  name: Updates During Installations / Removals
  family: Configuration Management
  description: |
    The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.
CM-8 (2):
  name: Automated Maintenance
  family: Configuration Management
  description: |
    The organization employs automated mechanisms to help maintain an up-to-date, complete, accurate, and readily available inventory of information system components.
CM-8 (3):
  name: Automated Unauthorized Component Detection
  family: Configuration Management
  description: |
    The organization:
      - **CM-8 (3)(a)** Employs automated mechanisms _[Assignment: organization-defined frequency]_ to detect the presence of unauthorized hardware, software, and firmware components within the information system; and
      - **CM-8 (3)(b)** Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; notifies _[Assignment: organization-defined personnel or roles]_].
CM-8 (4):
  name: Accountability Information
  family: Configuration Management
  description: |
    The organization includes in the information system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible/accountable for administering those components.
CM-8 (5):
  name: No Duplicate Accounting of Components
  family: Configuration Management
  description: |
    The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.
CM-8 (6):
  name: Assessed Configurations / Approved Deviations
  family: Configuration Management
  description: |
    The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.
CM-8 (7):
  name: Centralized Repository
  family: Configuration Management
  description: |
    The organization provides a centralized repository for the inventory of information system components.
CM-8 (8):
  name: Automated Location Tracking
  family: Configuration Management
  description: |
    The organization employs automated mechanisms to support tracking of information system components by geographic location.
CM-8 (9):
  name: Assignment of Components to Systems
  family: Configuration Management
  description: |
    The organization:
      - **CM-8 (9)(a)** Assigns _[Assignment: organization-defined acquired information system components]_ to an information system; and
      - **CM-8 (9)(b)** Receives an acknowledgement from the information system owner of this assignment.
CM-9:
  name: Configuration Management Plan
  family: Configuration Management
  description: |
    The organization develops, documents, and implements a configuration management plan for the information system that:
      - **CM-9a.** Addresses roles, responsibilities, and configuration management processes and procedures;
      - **CM-9b.** Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;
      - **CM-9c.** Defines the configuration items for the information system and places the configuration items under configuration management; and
      - **CM-9d.** Protects the configuration management plan from unauthorized disclosure and modification.
CM-9 (1):
  name: Assignment of Responsibility
  family: Configuration Management
  description: |
    The organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in information system development.
CM-10:
  name: Software Usage Restrictions
  family: Configuration Management
  description: |
    The organization:
      - **CM-10a.** Uses software and associated documentation in accordance with contract agreements and copyright laws;
      - **CM-10b.** Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
      - **CM-10c.** Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CM-10 (1):
  name: Open Source Software
  family: Configuration Management
  description: |
    The organization establishes the following restrictions on the use of open source software: _[Assignment: organization-defined restrictions]_.
CM-11:
  name: User-installed Software
  family: Configuration Management
  description: |
    The organization:
      - **CM-11a.** Establishes _[Assignment: organization-defined policies]_ governing the installation of software by users;
      - **CM-11b.** Enforces software installation policies through _[Assignment: organization-defined methods]_; and
      - **CM-11c.** Monitors policy compliance at _[Assignment: organization-defined frequency]_.
CM-11 (1):
  name: Alerts for Unauthorized Installations
  family: Configuration Management
  description: |
    The information system alerts _[Assignment: organization-defined personnel or roles]_ when the unauthorized installation of software is detected.
CM-11 (2):
  name: Prohibit Installation Without Privileged Status
  family: Configuration Management
  description: |
    The information system prohibits user installation of software without explicit privileged status.
CP-1:
  name: Contingency Planning Policy and Procedures
  family: Contingency Planning
  description: |
    The organization:
      - **CP-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **CP-1a.1.** A contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **CP-1a.2.** Procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls; and
      - **CP-1b.** Reviews and updates the current:
        - **CP-1b.1.** Contingency planning policy _[Assignment: organization-defined frequency]_; and
        - **CP-1b.2.** Contingency planning procedures _[Assignment: organization-defined frequency]_.
CP-2:
  name: Contingency Plan
  family: Contingency Planning
  description: |
    The organization:
      - **CP-2a.** Develops a contingency plan for the information system that:
        - **CP-2a.1.** Identifies essential missions and business functions and associated contingency requirements;
        - **CP-2a.2.** Provides recovery objectives, restoration priorities, and metrics;
        - **CP-2a.3.** Addresses contingency roles, responsibilities, assigned individuals with contact information;
        - **CP-2a.4.** Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
        - **CP-2a.5.** Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and
        - **CP-2a.6.** Is reviewed and approved by _[Assignment: organization-defined personnel or roles]_;
      - **CP-2b.** Distributes copies of the contingency plan to _[Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]_;
      - **CP-2c.** Coordinates contingency planning activities with incident handling activities;
      - **CP-2d.** Reviews the contingency plan for the information system _[Assignment: organization-defined frequency]_;
      - **CP-2e.** Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
      - **CP-2f.** Communicates contingency plan changes to _[Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]_; and
      - **CP-2g.** Protects the contingency plan from unauthorized disclosure and modification.
CP-2 (1):
  name: Coordinate With Related Plans
  family: Contingency Planning
  description: |
    The organization coordinates contingency plan development with organizational elements responsible for related plans.
CP-2 (2):
  name: Capacity Planning
  family: Contingency Planning
  description: |
    The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
CP-2 (3):
  name: Resume Essential Missions / Business Functions
  family: Contingency Planning
  description: |
    The organization plans for the resumption of essential missions and business functions within _[Assignment: organization-defined time period]_ of contingency plan activation.
CP-2 (4):
  name: Resume All Missions / Business Functions
  family: Contingency Planning
  description: |
    The organization plans for the resumption of all missions and business functions within _[Assignment: organization-defined time period]_ of contingency plan activation.
CP-2 (5):
  name: Continue  Essential Missions / Business Functions
  family: Contingency Planning
  description: |
    The organization plans for the continuance of essential missions and business functions with little or no loss of operational continuity and sustains that continuity until full information system restoration at primary processing and/or storage sites.
CP-2 (6):
  name: Alternate Processing / Storage Site
  family: Contingency Planning
  description: |
    The organization plans for the transfer of essential missions and business functions to alternate processing and/or storage sites with little or no loss of operational continuity and sustains that continuity through information system restoration to primary processing and/or storage sites.
CP-2 (7):
  name: Coordinate  With External Service Providers
  family: Contingency Planning
  description: |
    The organization coordinates its contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
CP-2 (8):
  name: Identify Critical Assets
  family: Contingency Planning
  description: |
    The organization identifies critical information system assets supporting essential missions and business functions.
CP-3:
  name: Contingency Training
  family: Contingency Planning
  description: |
    The organization provides contingency training to information system users consistent with assigned roles and responsibilities:
      - **CP-3a.** Within _[Assignment: organization-defined time period]_ of assuming a contingency role or responsibility;
      - **CP-3b.** When required by information system changes; and
      - **CP-3c.** _[Assignment: organization-defined frequency]_ thereafter.
CP-3 (1):
  name: Simulated Events
  family: Contingency Planning
  description: |
    The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.
CP-3 (2):
  name: Automated Training Environments
  family: Contingency Planning
  description: |
    The organization employs automated mechanisms to provide a more thorough and realistic contingency training environment.
CP-4:
  name: Contingency Plan Testing
  family: Contingency Planning
  description: |
    The organization:
      - **CP-4a.** Tests the contingency plan for the information system _[Assignment: organization-defined frequency]_ using _[Assignment: organization-defined tests]_ to determine the effectiveness of the plan and the organizational readiness to execute the plan;
      - **CP-4b.** Reviews the contingency plan test results; and
      - **CP-4c.** Initiates corrective actions, if needed.
CP-4 (1):
  name: Coordinate With Related Plans
  family: Contingency Planning
  description: |
    The organization coordinates contingency plan testing with organizational elements responsible for related plans.
CP-4 (2):
  name: Alternate Processing Site
  family: Contingency Planning
  description: |
    The organization tests the contingency plan at the alternate processing site:
      - **CP-4 (2)(a)** To familiarize contingency personnel with the facility and available resources; and
      - **CP-4 (2)(b)** To evaluate the capabilities of the alternate processing site to support contingency operations.
CP-4 (3):
  name: Automated Testing
  family: Contingency Planning
  description: |
    The organization employs automated mechanisms to more thoroughly and effectively test the contingency plan.
CP-4 (4):
  name: Full Recovery / Reconstitution
  family: Contingency Planning
  description: |
    The organization includes a full recovery and reconstitution of the information system to a known state as part of contingency plan testing.
CP-5:
  name: Contingency Plan Update
  family: Contingency Planning
  description: |
    _[Withdrawn: Incorporated into CP-2]_.
CP-6:
  name: Alternate Storage Site
  family: Contingency Planning
  description: |
    The organization:
      - **CP-6a.** Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and
      - **CP-6b.** Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CP-6 (1):
  name: Separation From Primary Site
  family: Contingency Planning
  description: |
    The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.
CP-6 (2):
  name: Recovery Time / Point Objectives
  family: Contingency Planning
  description: |
    The organization configures the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
CP-6 (3):
  name: Accessibility
  family: Contingency Planning
  description: |
    The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
CP-7:
  name: Alternate Processing Site
  family: Contingency Planning
  description: |
    The organization:
      - **CP-7a.** Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of _[Assignment: organization-defined information system operations]_ for essential missions/business functions within _[Assignment: organization-defined time period consistent with recovery time and recovery point objectives]_ when the primary processing capabilities are unavailable;
      - **CP-7b.** Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and
      - **CP-7c.** Ensures that the alternate processing site provides information security safeguards equivalent to those of the primary site.
CP-7 (1):
  name: Separation From Primary Site
  family: Contingency Planning
  description: |
    The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.
CP-7 (2):
  name: Accessibility
  family: Contingency Planning
  description: |
    The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
CP-7 (3):
  name: Priority of Service
  family: Contingency Planning
  description: |
    The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives).
CP-7 (4):
  name: Preparation for Use
  family: Contingency Planning
  description: |
    The organization prepares the alternate processing site so that the site is ready to be used as the operational site supporting essential missions and business functions.
CP-7 (5):
  name: Equivalent Information Security Safeguards
  family: Contingency Planning
  description: |
    _[Withdrawn: Incorporated into CP-7]_.
CP-7 (6):
  name: Inability to Return to Primary Site
  family: Contingency Planning
  description: |
    The organization plans and prepares for circumstances that preclude returning to the primary processing site.
CP-8:
  name: Telecommunications Services
  family: Contingency Planning
  description: |
    The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of _[Assignment: organization-defined information system operations]_ for essential missions and business functions within _[Assignment: organization-defined time period]_ when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CP-8 (1):
  name: Priority of Service Provisions
  family: Contingency Planning
  description: |
    The organization:
      - **CP-8 (1)(a)** Develops primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and
      - **CP-8 (1)(b)** Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.
CP-8 (2):
  name: Single Points of Failure
  family: Contingency Planning
  description: |
    The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
CP-8 (3):
  name: Separation of Primary / Alternate Providers
  family: Contingency Planning
  description: |
    The organization obtains alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
CP-8 (4):
  name: Provider Contingency Plan
  family: Contingency Planning
  description: |
    The organization:
      - **CP-8 (4)(a)** Requires primary and alternate telecommunications service providers to have contingency plans;
      - **CP-8 (4)(b)** Reviews provider contingency plans to ensure that the plans meet organizational contingency requirements; and
      - **CP-8 (4)(c)** Obtains evidence of contingency testing/training by providers _[Assignment: organization-defined frequency]_.
CP-8 (5):
  name: Alternate Telecommunication Service Testing
  family: Contingency Planning
  description: |
    The organization tests alternate telecommunication services _[Assignment: organization-defined frequency]_.
CP-9:
  name: Information System Backup
  family: Contingency Planning
  description: |
    The organization:
      - **CP-9a.** Conducts backups of user-level information contained in the information system _[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]_;
      - **CP-9b.** Conducts backups of system-level information contained in the information system _[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]_;
      - **CP-9c.** Conducts backups of information system documentation including security-related documentation _[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]_; and
      - **CP-9d.** Protects the confidentiality, integrity, and availability of backup information at storage locations.
CP-9 (1):
  name: Testing for Reliability / Integrity
  family: Contingency Planning
  description: |
    The organization tests backup information _[Assignment: organization-defined frequency]_ to verify media reliability and information integrity.
CP-9 (2):
  name: Test Restoration Using Sampling
  family: Contingency Planning
  description: |
    The organization uses a sample of backup information in the restoration of selected information system functions as part of contingency plan testing.
CP-9 (3):
  name: Separate Storage for Critical Information
  family: Contingency Planning
  description: |
    The organization stores backup copies of _[Assignment: organization-defined critical information system software and other security-related information]_ in a separate facility or in a fire-rated container that is not collocated with the operational system.
CP-9 (4):
  name: Protection From Unauthorized Modification
  family: Contingency Planning
  description: |
    _[Withdrawn: Incorporated into CP-9]_.
CP-9 (5):
  name: Transfer to Alternate Storage Site
  family: Contingency Planning
  description: |
    The organization transfers information system backup information to the alternate storage site _[Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives]_.
CP-9 (6):
  name: Redundant Secondary System
  family: Contingency Planning
  description: |
    The organization accomplishes information system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.
CP-9 (7):
  name: Dual Authorization
  family: Contingency Planning
  description: |
    The organization enforces dual authorization for the deletion or destruction of _[Assignment: organization-defined backup information]_.
CP-10:
  name: Information System Recovery and Reconstitution
  family: Contingency Planning
  description: |
    The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.
CP-10 (1):
  name: Contingency Plan Testing
  family: Contingency Planning
  description: |
    _[Withdrawn: Incorporated into CP-4]_.
CP-10 (2):
  name: Transaction Recovery
  family: Contingency Planning
  description: |
    The information system implements transaction recovery for systems that are transaction-based.
CP-10 (3):
  name: Compensating Security Controls
  family: Contingency Planning
  description: |
    _[Withdrawn: Addressed through tailoring procedures]_.
CP-10 (4):
  name: Restore Within Time Period
  family: Contingency Planning
  description: |
    The organization provides the capability to restore information system components within _[Assignment: organization-defined restoration time-periods]_ from configuration-controlled and integrity-protected information representing a known, operational state for the components.
CP-10 (5):
  name: Failover Capability
  family: Contingency Planning
  description: |
    _[Withdrawn: Incorporated into SI-13]_.
CP-10 (6):
  name: Component Protection
  family: Contingency Planning
  description: |
    The organization protects backup and restoration hardware, firmware, and software.
CP-11:
  name: Alternate Communications Protocols
  family: Contingency Planning
  description: |
    The information system provides the capability to employ _[Assignment: organization-defined alternative communications protocols]_ in support of maintaining continuity of operations.
CP-12:
  name: Safe Mode
  family: Contingency Planning
  description: |
    The information system, when _[Assignment: organization-defined conditions]_ are detected, enters a safe mode of operation with _[Assignment: organization-defined restrictions of safe mode of operation]_.
CP-13:
  name: Alternative Security Mechanisms
  family: Contingency Planning
  description: |
    The organization employs _[Assignment: organization-defined alternative or supplemental security mechanisms]_ for satisfying _[Assignment: organization-defined security functions]_ when the primary means of implementing the security function is unavailable or compromised.
IA-1:
  name: Identification and Authentication Policy and Procedures
  family: Identification and Authentication
  description: |
    The organization:
      - **IA-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **IA-1a.1.** An identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **IA-1a.2.** Procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls; and
      - **IA-1b.** Reviews and updates the current:
        - **IA-1b.1.** Identification and authentication policy _[Assignment: organization-defined frequency]_; and
        - **IA-1b.2.** Identification and authentication procedures _[Assignment: organization-defined frequency]_.
IA-2:
  name: Identification and Authentication (organizational Users)
  family: Identification and Authentication
  description: |
    The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-2 (1):
  name: Network Access to Privileged Accounts
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for network access to privileged accounts.
IA-2 (2):
  name: Network Access to Non-privileged Accounts
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for network access to non-privileged accounts.
IA-2 (3):
  name: Local Access to Privileged Accounts
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for local access to privileged accounts.
IA-2 (4):
  name: Local Access to Non-privileged Accounts
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for local access to non-privileged accounts.
IA-2 (5):
  name: Group Authentication
  family: Identification and Authentication
  description: |
    The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.
IA-2 (6):
  name: Network Access to Privileged Accounts - Separate Device
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets _[Assignment: organization-defined strength of mechanism requirements]_.
IA-2 (7):
  name: Network Access to Non-privileged Accounts - Separate Device
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets _[Assignment: organization-defined strength of mechanism requirements]_.
IA-2 (8):
  name: Network Access to Privileged Accounts - Replay Resistant
  family: Identification and Authentication
  description: |
    The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.
IA-2 (9):
  name: Network Access to Non-privileged Accounts - Replay Resistant
  family: Identification and Authentication
  description: |
    The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.
IA-2 (10):
  name: Single Sign-on
  family: Identification and Authentication
  description: |
    The information system provides a single sign-on capability for _[Assignment: organization-defined information system accounts and services]_.
IA-2 (11):
  name: Remote Access  - Separate Device
  family: Identification and Authentication
  description: |
    The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets _[Assignment: organization-defined strength of mechanism requirements]_.
IA-2 (12):
  name: Acceptance of Piv Credentials
  family: Identification and Authentication
  description: |
    The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials.
IA-2 (13):
  name: Out-of-band Authentication
  family: Identification and Authentication
  description: |
    The information system implements _[Assignment: organization-defined out-of-band authentication]_ under _[Assignment: organization-defined conditions]_.
IA-3:
  name: Device Identification and Authentication
  family: Identification and Authentication
  description: |
    The information system uniquely identifies and authenticates _[Assignment: organization-defined specific and/or types of devices]_ before establishing a [Selection (one or more): local; remote; network] connection.
IA-3 (1):
  name: Cryptographic Bidirectional Authentication
  family: Identification and Authentication
  description: |
    The information system authenticates _[Assignment: organization-defined specific devices and/or types of devices]_ before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based.
IA-3 (2):
  name: Cryptographic Bidirectional Network Authentication
  family: Identification and Authentication
  description: |
    _[Withdrawn: Incorporated into IA-3 (1)]_.
IA-3 (3):
  name: Dynamic Address Allocation
  family: Identification and Authentication
  description: |
    The organization:
      - **IA-3 (3)(a)** Standardizes dynamic address allocation lease information and the lease duration assigned to devices in accordance with _[Assignment: organization-defined lease information and lease duration]_; and
      - **IA-3 (3)(b)** Audits lease information when assigned to a device.
IA-3 (4):
  name: Device Attestation
  family: Identification and Authentication
  description: |
    The organization ensures that device identification and authentication based on attestation is handled by _[Assignment: organization-defined configuration management process]_.
IA-4:
  name: Identifier Management
  family: Identification and Authentication
  description: |
    The organization manages information system identifiers by:
      - **IA-4a.** Receiving authorization from _[Assignment: organization-defined personnel or roles]_ to assign an individual, group, role, or device identifier;
      - **IA-4b.** Selecting an identifier that identifies an individual, group, role, or device;
      - **IA-4c.** Assigning the identifier to the intended individual, group, role, or device;
      - **IA-4d.** Preventing reuse of identifiers for _[Assignment: organization-defined time period]_; and
      - **IA-4e.** Disabling the identifier after _[Assignment: organization-defined time period of inactivity]_.
IA-4 (1):
  name: Prohibit Account Identifiers As Public Identifiers
  family: Identification and Authentication
  description: |
    The organization prohibits the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.
IA-4 (2):
  name: Supervisor Authorization
  family: Identification and Authentication
  description: |
    The organization requires that the registration process to receive an individual identifier includes supervisor authorization.
IA-4 (3):
  name: Multiple Forms of Certification
  family: Identification and Authentication
  description: |
    The organization requires multiple forms of certification of individual identification be presented to the registration authority.
IA-4 (4):
  name: Identify User Status
  family: Identification and Authentication
  description: |
    The organization manages individual identifiers by uniquely identifying each individual as _[Assignment: organization-defined characteristic identifying individual status]_.
IA-4 (5):
  name: Dynamic Management
  family: Identification and Authentication
  description: |
    The information system dynamically manages identifiers.
IA-4 (6):
  name: Cross-organization Management
  family: Identification and Authentication
  description: |
    The organization coordinates with _[Assignment: organization-defined external organizations]_ for cross-organization management of identifiers.
IA-4 (7):
  name: In-person Registration
  family: Identification and Authentication
  description: |
    The organization requires that the registration process to receive an individual identifier be conducted in person before a designated registration authority.
IA-5:
  name: Authenticator Management
  family: Identification and Authentication
  description: |
    The organization manages information system authenticators by:
      - **IA-5a.** Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;
      - **IA-5b.** Establishing initial authenticator content for authenticators defined by the organization;
      - **IA-5c.** Ensuring that authenticators have sufficient strength of mechanism for their intended use;
      - **IA-5d.** Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;
      - **IA-5e.** Changing default content of authenticators prior to information system installation;
      - **IA-5f.** Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;
      - **IA-5g.** Changing/refreshing authenticators _[Assignment: organization-defined time period by authenticator type]_;
      - **IA-5h.** Protecting authenticator content from unauthorized disclosure and modification;
      - **IA-5i.** Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and
      - **IA-5j.** Changing authenticators for group/role accounts when membership to those accounts changes.
IA-5 (1):
  name: Password-based Authentication
  family: Identification and Authentication
  description: |
    The information system, for password-based authentication:
      - **IA-5 (1)(a)** Enforces minimum password complexity of _[Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type]_;
      - **IA-5 (1)(b)** Enforces at least the following number of changed characters when new passwords are created: _[Assignment: organization-defined number]_;
      - **IA-5 (1)(c)** Stores and transmits only cryptographically-protected passwords;
      - **IA-5 (1)(d)** Enforces password minimum and maximum lifetime restrictions of _[Assignment: organization-defined numbers for lifetime minimum, lifetime maximum]_;
      - **IA-5 (1)(e)** Prohibits password reuse for _[Assignment: organization-defined number]_ generations; and
      - **IA-5 (1)(f)** Allows the use of a temporary password for system logons with an immediate change to a permanent password.
IA-5 (2):
  name: Pki-based Authentication
  family: Identification and Authentication
  description: |
    The information system, for PKI-based authentication:
      - **IA-5 (2)(a)** Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;
      - **IA-5 (2)(b)** Enforces authorized access to the corresponding private key;
      - **IA-5 (2)(c)** Maps the authenticated identity to the account of the individual or group; and
      - **IA-5 (2)(d)** Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.
IA-5 (3):
  name: In-person or Trusted Third-party Registration
  family: Identification and Authentication
  description: |
    The organization requires that the registration process to receive _[Assignment: organization-defined types of and/or specific authenticators]_ be conducted [Selection: in person; by a trusted third party] before _[Assignment: organization-defined registration authority]_ with authorization by _[Assignment: organization-defined personnel or roles]_.
IA-5 (4):
  name: Automated Support  for Password Strength Determination
  family: Identification and Authentication
  description: |
    The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy _[Assignment: organization-defined requirements]_.
IA-5 (5):
  name: Change Authenticators Prior to Delivery
  family: Identification and Authentication
  description: |
    The organization requires developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.
IA-5 (6):
  name: Protection of Authenticators
  family: Identification and Authentication
  description: |
    The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.
IA-5 (7):
  name: No Embedded Unencrypted Static Authenticators
  family: Identification and Authentication
  description: |
    The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.
IA-5 (8):
  name: Multiple Information System Accounts
  family: Identification and Authentication
  description: |
    The organization implements _[Assignment: organization-defined security safeguards]_ to manage the risk of compromise due to individuals having accounts on multiple information systems.
IA-5 (9):
  name: Cross-organization Credential Management
  family: Identification and Authentication
  description: |
    The organization coordinates with _[Assignment: organization-defined external organizations]_ for cross-organization management of credentials.
IA-5 (10):
  name: Dynamic Credential Association
  family: Identification and Authentication
  description: |
    The information system dynamically provisions identities.
IA-5 (11):
  name: Hardware Token-based Authentication
  family: Identification and Authentication
  description: |
    The information system, for hardware token-based authentication, employs mechanisms that satisfy _[Assignment: organization-defined token quality requirements]_.
IA-5 (12):
  name: Biometric-based Authentication
  family: Identification and Authentication
  description: |
    The information system, for biometric-based authentication, employs mechanisms that satisfy _[Assignment: organization-defined biometric quality requirements]_.
IA-5 (13):
  name: Expiration of Cached Authenticators
  family: Identification and Authentication
  description: |
    The information system prohibits the use of cached authenticators after _[Assignment: organization-defined time period]_.
IA-5 (14):
  name: Managing Content of Pki Trust Stores
  family: Identification and Authentication
  description: |
    The organization, for PKI-based authentication, employs a deliberate organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.
IA-5 (15):
  name: Ficam-approved Products and Services
  family: Identification and Authentication
  description: |
    The organization uses only FICAM-approved path discovery and validation products and services.
IA-6:
  name: Authenticator Feedback
  family: Identification and Authentication
  description: |
    The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
IA-7:
  name: Cryptographic Module Authentication
  family: Identification and Authentication
  description: |
    The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
IA-8:
  name: Identification and Authentication (non-organizational Users)
  family: Identification and Authentication
  description: |
    The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
IA-8 (1):
  name: Acceptance of Piv Credentials From Other Agencies
  family: Identification and Authentication
  description: |
    The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.
IA-8 (2):
  name: Acceptance of Third-party Credentials
  family: Identification and Authentication
  description: |
    The information system accepts only FICAM-approved third-party credentials.
IA-8 (3):
  name: Use of Ficam-approved Products
  family: Identification and Authentication
  description: |
    The organization employs only FICAM-approved information system components in _[Assignment: organization-defined information systems]_ to accept third-party credentials.
IA-8 (4):
  name: Use of Ficam-issued Profiles
  family: Identification and Authentication
  description: |
    The information system conforms to FICAM-issued profiles.
IA-8 (5):
  name: Acceptance of Piv-i Credentials
  family: Identification and Authentication
  description: |
    The information system accepts and electronically verifies Personal Identity Verification-I (PIV-I) credentials.
IA-9:
  name: Service Identification and Authentication
  family: Identification and Authentication
  description: |
    The organization identifies and authenticates _[Assignment: organization-defined information system services]_ using _[Assignment: organization-defined security safeguards]_.
IA-9 (1):
  name: Information Exchange
  family: Identification and Authentication
  description: |
    The organization ensures that service providers receive, validate, and transmit identification and authentication information.
IA-9 (2):
  name: Transmission of Decisions
  family: Identification and Authentication
  description: |
    The organization ensures that identification and authentication decisions are transmitted between _[Assignment: organization-defined services]_ consistent with organizational policies.
IA-10:
  name: Adaptive Identification and Authentication
  family: Identification and Authentication
  description: |
    The organization requires that individuals accessing the information system employ _[Assignment: organization-defined supplemental authentication techniques or mechanisms]_ under specific _[Assignment: organization-defined circumstances or situations]_.
IA-11:
  name: Re-authentication
  family: Identification and Authentication
  description: |
    The organization requires users and devices to re-authenticate when _[Assignment: organization-defined circumstances or situations requiring re-authentication]_.
IR-1:
  name: Incident Response Policy and Procedures
  family: Incident Response
  description: |
    The organization:
      - **IR-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **IR-1a.1.** An incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **IR-1a.2.** Procedures to facilitate the implementation of the incident response policy and associated incident response controls; and
      - **IR-1b.** Reviews and updates the current:
        - **IR-1b.1.** Incident response policy _[Assignment: organization-defined frequency]_; and
        - **IR-1b.2.** Incident response procedures _[Assignment: organization-defined frequency]_.
IR-2:
  name: Incident Response Training
  family: Incident Response
  description: |
    The organization provides incident response training to information system users consistent with assigned roles and responsibilities:
      - **IR-2a.** Within _[Assignment: organization-defined time period]_ of assuming an incident response role or responsibility;
      - **IR-2b.** When required by information system changes; and
      - **IR-2c.** _[Assignment: organization-defined frequency]_ thereafter.
IR-2 (1):
  name: Simulated Events
  family: Incident Response
  description: |
    The organization incorporates simulated events into incident response training to facilitate effective response by personnel in crisis situations.
IR-2 (2):
  name: Automated Training Environments
  family: Incident Response
  description: |
    The organization employs automated mechanisms to provide a more thorough and realistic incident response training environment.
IR-3:
  name: Incident Response Testing
  family: Incident Response
  description: |
    The organization tests the incident response capability for the information system _[Assignment: organization-defined frequency]_ using _[Assignment: organization-defined tests]_ to determine the incident response effectiveness and documents the results.
IR-3 (1):
  name: Automated Testing
  family: Incident Response
  description: |
    The organization employs automated mechanisms to more thoroughly and effectively test the incident response capability.
IR-3 (2):
  name: Coordination With Related Plans
  family: Incident Response
  description: |
    The organization coordinates incident response testing with organizational elements responsible for related plans.
IR-4:
  name: Incident Handling
  family: Incident Response
  description: |
    The organization:
      - **IR-4a.** Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;
      - **IR-4b.** Coordinates incident handling activities with contingency planning activities; and
      - **IR-4c.** Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.
IR-4 (1):
  name: Automated Incident Handling Processes
  family: Incident Response
  description: |
    The organization employs automated mechanisms to support the incident handling process.
IR-4 (2):
  name: Dynamic Reconfiguration
  family: Incident Response
  description: |
    The organization includes dynamic reconfiguration of _[Assignment: organization-defined information system components]_ as part of the incident response capability.
IR-4 (3):
  name: Continuity of Operations
  family: Incident Response
  description: |
    The organization identifies _[Assignment: organization-defined classes of incidents]_ and _[Assignment: organization-defined actions to take in response to classes of incidents]_ to ensure continuation of organizational missions and business functions.
IR-4 (4):
  name: Information Correlation
  family: Incident Response
  description: |
    The organization correlates incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
IR-4 (5):
  name: Automatic Disabling of Information System
  family: Incident Response
  description: |
    The organization implements a configurable capability to automatically disable the information system if _[Assignment: organization-defined security violations]_ are detected.
IR-4 (6):
  name: Insider Threats - Specific Capabilities
  family: Incident Response
  description: |
    The organization implements incident handling capability for insider threats.
IR-4 (7):
  name: Insider Threats - Intra-organization Coordination
  family: Incident Response
  description: |
    The organization coordinates incident handling capability for insider threats across _[Assignment: organization-defined components or elements of the organization]_.
IR-4 (8):
  name: Correlation With External Organizations
  family: Incident Response
  description: |
    The organization coordinates with _[Assignment: organization-defined external organizations]_ to correlate and share _[Assignment: organization-defined incident information]_ to achieve a cross-organization perspective on incident awareness and more effective incident responses.
IR-4 (9):
  name: Dynamic Response Capability
  family: Incident Response
  description: |
    The organization employs _[Assignment: organization-defined dynamic response capabilities]_ to effectively respond to security incidents.
IR-4 (10):
  name: Supply Chain Coordination
  family: Incident Response
  description: |
    The organization coordinates incident handling activities involving supply chain events with other organizations involved in the supply chain.
IR-5:
  name: Incident Monitoring
  family: Incident Response
  description: |
    The organization tracks and documents information system security incidents.
IR-5 (1):
  name: Automated Tracking / Data Collection / Analysis
  family: Incident Response
  description: |
    The organization employs automated mechanisms to assist in the tracking of security incidents and in the collection and analysis of incident information.
IR-6:
  name: Incident Reporting
  family: Incident Response
  description: |
    The organization:
      - **IR-6a.** Requires personnel to report suspected security incidents to the organizational incident response capability within _[Assignment: organization-defined time period]_; and
      - **IR-6b.** Reports security incident information to _[Assignment: organization-defined authorities]_.
IR-6 (1):
  name: Automated Reporting
  family: Incident Response
  description: |
    The organization employs automated mechanisms to assist in the reporting of security incidents.
IR-6 (2):
  name: Vulnerabilities Related to Incidents
  family: Incident Response
  description: |
    The organization reports information system vulnerabilities associated with reported security incidents to _[Assignment: organization-defined personnel or roles]_.
IR-6 (3):
  name: Coordination With Supply Chain
  family: Incident Response
  description: |
    The organization provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.
IR-7:
  name: Incident Response Assistance
  family: Incident Response
  description: |
    The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.
IR-7 (1):
  name: Automation Support for Availability of Information / Support
  family: Incident Response
  description: |
    The organization employs automated mechanisms to increase the availability of incident response-related information and support.
IR-7 (2):
  name: Coordination With External Providers
  family: Incident Response
  description: |
    The organization:
      - **IR-7 (2)(a)** Establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability; and
      - **IR-7 (2)(b)** Identifies organizational incident response team members to the external providers.
IR-8:
  name: Incident Response Plan
  family: Incident Response
  description: |
    The organization:
      - **IR-8a.** Develops an incident response plan that:
        - **IR-8a.1.** Provides the organization with a roadmap for implementing its incident response capability;
        - **IR-8a.2.** Describes the structure and organization of the incident response capability;
        - **IR-8a.3.** Provides a high-level approach for how the incident response capability fits into the overall organization;
        - **IR-8a.4.** Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
        - **IR-8a.5.** Defines reportable incidents;
        - **IR-8a.6.** Provides metrics for measuring the incident response capability within the organization;
        - **IR-8a.7.** Defines the resources and management support needed to effectively maintain and mature an incident response capability; and
        - **IR-8a.8.** Is reviewed and approved by _[Assignment: organization-defined personnel or roles]_;
      - **IR-8b.** Distributes copies of the incident response plan to _[Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements]_;
      - **IR-8c.** Reviews the incident response plan _[Assignment: organization-defined frequency]_;
      - **IR-8d.** Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing;
      - **IR-8e.** Communicates incident response plan changes to _[Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements]_; and
      - **IR-8f.** Protects the incident response plan from unauthorized disclosure and modification.
IR-9:
  name: Information Spillage Response
  family: Incident Response
  description: |
    The organization responds to information spills by:
      - **IR-9a.** Identifying the specific information involved in the information system contamination;
      - **IR-9b.** Alerting _[Assignment: organization-defined personnel or roles]_ of the information spill using a method of communication not associated with the spill;
      - **IR-9c.** Isolating the contaminated information system or system component;
      - **IR-9d.** Eradicating the information from the contaminated information system or component;
      - **IR-9e.** Identifying other information systems or system components that may have been subsequently contaminated; and
      - **IR-9f.** Performing other _[Assignment: organization-defined actions]_.
IR-9 (1):
  name: Responsible Personnel
  family: Incident Response
  description: |
    The organization assigns _[Assignment: organization-defined personnel or roles]_ with responsibility for responding to information spills.
IR-9 (2):
  name: Training
  family: Incident Response
  description: |
    The organization provides information spillage response training _[Assignment: organization-defined frequency]_.
IR-9 (3):
  name: Post-spill Operations
  family: Incident Response
  description: |
    The organization implements _[Assignment: organization-defined procedures]_ to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
IR-9 (4):
  name: Exposure to Unauthorized Personnel
  family: Incident Response
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ for personnel exposed to information not within assigned access authorizations.
IR-10:
  name: Integrated Information Security Analysis Team
  family: Incident Response
  description: |
    The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.
MA-1:
  name: System Maintenance Policy and Procedures
  family: Maintenance
  description: |
    The organization:
      - **MA-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **MA-1a.1.** A system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **MA-1a.2.** Procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls; and
      - **MA-1b.** Reviews and updates the current:
        - **MA-1b.1.** System maintenance policy _[Assignment: organization-defined frequency]_; and
        - **MA-1b.2.** System maintenance procedures _[Assignment: organization-defined frequency]_.
MA-2:
  name: Controlled Maintenance
  family: Maintenance
  description: |
    The organization:
      - **MA-2a.** Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
      - **MA-2b.** Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;
      - **MA-2c.** Requires that _[Assignment: organization-defined personnel or roles]_ explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;
      - **MA-2d.** Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;
      - **MA-2e.** Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and
      - **MA-2f.** Includes _[Assignment: organization-defined maintenance-related information]_ in organizational maintenance records.
MA-2 (1):
  name: Record Content
  family: Maintenance
  description: |
    _[Withdrawn: Incorporated into MA-2]_.
MA-2 (2):
  name: Automated Maintenance Activities
  family: Maintenance
  description: |
    The organization:
      - **MA-2 (2)(a)** Employs automated mechanisms to schedule, conduct, and document maintenance and repairs; and
      - **MA-2 (2)(b)** Produces up-to date, accurate, and complete records of all maintenance and repair actions requested, scheduled, in process, and completed.
MA-3:
  name: Maintenance Tools
  family: Maintenance
  description: |
    The organization approves, controls, and monitors information system maintenance tools.
MA-3 (1):
  name: Inspect Tools
  family: Maintenance
  description: |
    The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.
MA-3 (2):
  name: Inspect Media
  family: Maintenance
  description: |
    The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.
MA-3 (3):
  name: Prevent Unauthorized Removal
  family: Maintenance
  description: |
    The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:
      - **MA-3 (3)(a)** Verifying that there is no organizational information contained on the equipment;
      - **MA-3 (3)(b)** Sanitizing or destroying the equipment;
      - **MA-3 (3)(c)** Retaining the equipment within the facility; or
      - **MA-3 (3)(d)** Obtaining an exemption from _[Assignment: organization-defined personnel or roles]_ explicitly authorizing removal of the equipment from the facility.
MA-3 (4):
  name: Restricted Tool Use
  family: Maintenance
  description: |
    The information system restricts the use of maintenance tools to authorized personnel only.
MA-4:
  name: Nonlocal Maintenance
  family: Maintenance
  description: |
    The organization:
      - **MA-4a.** Approves and monitors nonlocal maintenance and diagnostic activities;
      - **MA-4b.** Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system;
      - **MA-4c.** Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;
      - **MA-4d.** Maintains records for nonlocal maintenance and diagnostic activities; and
      - **MA-4e.** Terminates session and network connections when nonlocal maintenance is completed.
MA-4 (1):
  name: Auditing and Review
  family: Maintenance
  description: |
    The organization:
      - **MA-4 (1)(a)** Audits nonlocal maintenance and diagnostic sessions _[Assignment: organization-defined audit events]_; and
      - **MA-4 (1)(b)** Reviews the records of the maintenance and diagnostic sessions.
MA-4 (2):
  name: Document Nonlocal Maintenance
  family: Maintenance
  description: |
    The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.
MA-4 (3):
  name: Comparable Security / Sanitization
  family: Maintenance
  description: |
    The organization:
      - **MA-4 (3)(a)** Requires that nonlocal maintenance and diagnostic services be performed from an information system that implements a security capability comparable to the capability implemented on the system being serviced; or
      - **MA-4 (3)(b)** Removes the component to be serviced from the information system prior to nonlocal maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities, and after the service is performed, inspects and sanitizes the component (with regard to potentially malicious software) before reconnecting the component to the information system.
MA-4 (4):
  name: Authentication / Separation of Maintenance Sessions
  family: Maintenance
  description: |
    The organization protects nonlocal maintenance sessions by:
      - **MA-4 (4)(a)** Employing _[Assignment: organization-defined authenticators that are replay resistant]_; and
      - **MA-4 (4)(b)** Separating the maintenance sessions from other network sessions with the information system by either:
        - **MA-4 (4)(b)(1)** Physically separated communications paths; or
        - **MA-4 (4)(b)(2)** Logically separated communications paths based upon encryption.
MA-4 (5):
  name: Approvals and Notifications
  family: Maintenance
  description: |
    The organization:
      - **MA-4 (5)(a)** Requires the approval of each nonlocal maintenance session by _[Assignment: organization-defined personnel or roles]_; and
      - **MA-4 (5)(b)** Notifies _[Assignment: organization-defined personnel or roles]_ of the date and time of planned nonlocal maintenance.
MA-4 (6):
  name: Cryptographic Protection
  family: Maintenance
  description: |
    The information system implements cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications.
MA-4 (7):
  name: Remote Disconnect Verification
  family: Maintenance
  description: |
    The information system implements remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.
MA-5:
  name: Maintenance Personnel
  family: Maintenance
  description: |
    The organization:
      - **MA-5a.** Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel;
      - **MA-5b.** Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and
      - **MA-5c.** Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
MA-5 (1):
  name: Individuals Without Appropriate Access
  family: Maintenance
  description: |
    The organization:
      - **MA-5 (1)(a)** Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
        - **MA-5 (1)(a)(1)** Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;
        - **MA-5 (1)(a)(2)** Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
      - **MA-5 (1)(b)** Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
MA-5 (2):
  name: Security Clearances for Classified Systems
  family: Maintenance
  description: |
    The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.
MA-5 (3):
  name: Citizenship Requirements for Classified Systems
  family: Maintenance
  description: |
    The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information are U.S. citizens.
MA-5 (4):
  name: Foreign Nationals
  family: Maintenance
  description: |
    The organization ensures that:
      - **MA-5 (4)(a)** Cleared foreign nationals (i.e., foreign nationals with appropriate security clearances), are used to conduct maintenance and diagnostic activities on classified information systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments; and
      - **MA-5 (4)(b)** Approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified information systems are fully documented within Memoranda of Agreements.
MA-5 (5):
  name: Nonsystem-related Maintenance
  family: Maintenance
  description: |
    The organization ensures that non-escorted personnel performing maintenance activities not directly associated with the information system but in the physical proximity of the system, have required access authorizations.
MA-6:
  name: Timely Maintenance
  family: Maintenance
  description: |
    The organization obtains maintenance support and/or spare parts for _[Assignment: organization-defined information system components]_ within _[Assignment: organization-defined time period]_ of failure.
MA-6 (1):
  name: Preventive Maintenance
  family: Maintenance
  description: |
    The organization performs preventive maintenance on _[Assignment: organization-defined information system components]_ at _[Assignment: organization-defined time intervals]_.
MA-6 (2):
  name: Predictive Maintenance
  family: Maintenance
  description: |
    The organization performs predictive maintenance on _[Assignment: organization-defined information system components]_ at _[Assignment: organization-defined time intervals]_.
MA-6 (3):
  name: Automated Support for Predictive Maintenance
  family: Maintenance
  description: |
    The organization employs automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system.
MP-1:
  name: Media Protection Policy and Procedures
  family: Media Protection
  description: |
    The organization:
      - **MP-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **MP-1a.1.** A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **MP-1a.2.** Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and
      - **MP-1b.** Reviews and updates the current:
        - **MP-1b.1.** Media protection policy _[Assignment: organization-defined frequency]_; and
        - **MP-1b.2.** Media protection procedures _[Assignment: organization-defined frequency]_.
MP-2:
  name: Media Access
  family: Media Protection
  description: |
    The organization restricts access to _[Assignment: organization-defined types of digital and/or non-digital media]_ to _[Assignment: organization-defined personnel or roles]_.
MP-2 (1):
  name: Automated Restricted Access
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into MP-4 (2)]_.
MP-2 (2):
  name: Cryptographic Protection
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into SC-28 (1)]_.
MP-3:
  name: Media Marking
  family: Media Protection
  description: |
    The organization:
      - **MP-3a.** Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
      - **MP-3b.** Exempts _[Assignment: organization-defined types of information system media]_ from marking as long as the media remain within _[Assignment: organization-defined controlled areas]_.
MP-4:
  name: Media Storage
  family: Media Protection
  description: |
    The organization:
      - **MP-4a.** Physically controls and securely stores _[Assignment: organization-defined types of digital and/or non-digital media]_ within _[Assignment: organization-defined controlled areas]_; and
      - **MP-4b.** Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-4 (1):
  name: Cryptographic Protection
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into SC-28 (1)]_.
MP-4 (2):
  name: Automated Restricted Access
  family: Media Protection
  description: |
    The organization employs automated mechanisms to restrict access to media storage areas and to audit access attempts and access granted.
MP-5:
  name: Media Transport
  family: Media Protection
  description: |
    The organization:
      - **MP-5a.** Protects and controls _[Assignment: organization-defined types of information system media]_ during transport outside of controlled areas using _[Assignment: organization-defined security safeguards]_;
      - **MP-5b.** Maintains accountability for information system media during transport outside of controlled areas;
      - **MP-5c.** Documents activities associated with the transport of information system media; and
      - **MP-5d.** Restricts the activities associated with the transport of information system media to authorized personnel.
MP-5 (1):
  name: Protection Outside of Controlled Areas
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into MP-5]_.
MP-5 (2):
  name: Documentation of Activities
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into MP-5]_.
MP-5 (3):
  name: Custodians
  family: Media Protection
  description: |
    The organization employs an identified custodian during transport of information system media outside of controlled areas.
MP-5 (4):
  name: Cryptographic Protection
  family: Media Protection
  description: |
    The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
MP-6:
  name: Media Sanitization
  family: Media Protection
  description: |
    The organization:
      - **MP-6a.** Sanitizes _[Assignment: organization-defined information system media]_ prior to disposal, release out of organizational control, or release for reuse using _[Assignment: organization-defined sanitization techniques and procedures]_ in accordance with applicable federal and organizational standards and policies; and
      - **MP-6b.** Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
MP-6 (1):
  name: Review / Approve / Track / Document / Verify
  family: Media Protection
  description: |
    The organization reviews, approves, tracks, documents, and verifies media sanitization and disposal actions.
MP-6 (2):
  name: Equipment Testing
  family: Media Protection
  description: |
    The organization tests sanitization equipment and procedures _[Assignment: organization-defined frequency]_ to verify that the intended sanitization is being achieved.
MP-6 (3):
  name: Nondestructive Techniques
  family: Media Protection
  description: |
    The organization applies nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the information system under the following circumstances: _[Assignment: organization-defined circumstances requiring sanitization of portable storage devices]_.
MP-6 (4):
  name: Controlled Unclassified Information
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into MP-6]_.
MP-6 (5):
  name: Classified Information
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into MP-6]_.
MP-6 (6):
  name: Media Destruction
  family: Media Protection
  description: |
    _[Withdrawn: Incorporated into MP-6]_.
MP-6 (7):
  name: Dual Authorization
  family: Media Protection
  description: |
    The organization enforces dual authorization for the sanitization of _[Assignment: organization-defined information system media]_.
MP-6 (8):
  name: Remote Purging / Wiping of Information
  family: Media Protection
  description: |
    The organization provides the capability to purge/wipe information from _[Assignment: organization-defined information systems, system components, or devices]_ either remotely or under the following conditions: _[Assignment: organization-defined conditions]_.
MP-7:
  name: Media Use
  family: Media Protection
  description: |
    The organization [Selection: restricts; prohibits] the use of _[Assignment: organization-defined types of information system media]_ on _[Assignment: organization-defined information systems or system components]_ using _[Assignment: organization-defined security safeguards]_.
MP-7 (1):
  name: Prohibit Use Without Owner
  family: Media Protection
  description: |
    The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.
MP-7 (2):
  name: Prohibit Use of Sanitization-resistant Media
  family: Media Protection
  description: |
    The organization prohibits the use of sanitization-resistant media in organizational information systems.
MP-8:
  name: Media Downgrading
  family: Media Protection
  description: |
    The organization:
      - **MP-8a.** Establishes _[Assignment: organization-defined information system media downgrading process]_ that includes employing downgrading mechanisms with _[Assignment: organization-defined strength and integrity]_;
      - **MP-8b.** Ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;
      - **MP-8c.** Identifies _[Assignment: organization-defined information system media requiring downgrading]_; and
      - **MP-8d.** Downgrades the identified information system media using the established process.
MP-8 (1):
  name: Documentation of Process
  family: Media Protection
  description: |
    The organization documents information system media downgrading actions.
MP-8 (2):
  name: Equipment Testing
  family: Media Protection
  description: |
    The organization employs _[Assignment: organization-defined tests]_ of downgrading equipment and procedures to verify correct performance _[Assignment: organization-defined frequency]_.
MP-8 (3):
  name: Controlled Unclassified Information
  family: Media Protection
  description: |
    The organization downgrades information system media containing _[Assignment: organization-defined Controlled Unclassified Information (CUI)]_ prior to public release in accordance with applicable federal and organizational standards and policies.
MP-8 (4):
  name: Classified Information
  family: Media Protection
  description: |
    The organization downgrades information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.
PE-1:
  name: Physical and Environmental Protection Policy and Procedures
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **PE-1a.1.** A physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **PE-1a.2.** Procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls; and
      - **PE-1b.** Reviews and updates the current:
        - **PE-1b.1.** Physical and environmental protection  policy _[Assignment: organization-defined frequency]_; and
        - **PE-1b.2.** Physical and environmental protection procedures _[Assignment: organization-defined frequency]_.
PE-2:
  name: Physical Access Authorizations
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-2a.** Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides;
      - **PE-2b.** Issues authorization credentials for facility access;
      - **PE-2c.** Reviews the access list detailing authorized facility access by individuals _[Assignment: organization-defined frequency]_; and
      - **PE-2d.** Removes individuals from the facility access list when access is no longer required.
PE-2 (1):
  name: Access by Position / Role
  family: Physical and Environmental Protection
  description: |
    The organization authorizes physical access to the facility where the information system resides based on position or role.
PE-2 (2):
  name: Two Forms of Identification
  family: Physical and Environmental Protection
  description: |
    The organization requires two forms of identification from _[Assignment: organization-defined list of acceptable forms of identification]_ for visitor access to the facility where the information system resides.
PE-2 (3):
  name: Restrict Unescorted Access
  family: Physical and Environmental Protection
  description: |
    The organization restricts unescorted access to the facility where the information system resides to personnel with [Selection (one or more): security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; _[Assignment: organization-defined credentials]_].
PE-3:
  name: Physical Access Control
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-3a.** Enforces physical access authorizations at _[Assignment: organization-defined entry/exit points to the facility where the information system resides]_ by;
        - **PE-3a.1.** Verifying individual access authorizations before granting access to the facility; and
        - **PE-3a.2.** Controlling ingress/egress to the facility using [Selection (one or more): _[Assignment: organization-defined physical access control systems/devices]_; guards];
      - **PE-3b.** Maintains physical access audit logs for _[Assignment: organization-defined entry/exit points]_;
      - **PE-3c.** Provides _[Assignment: organization-defined security safeguards]_ to control access to areas within the facility officially designated as publicly accessible;
      - **PE-3d.** Escorts visitors and monitors visitor activity _[Assignment: organization-defined circumstances requiring visitor escorts and monitoring]_;
      - **PE-3e.** Secures keys, combinations, and other physical access devices;
      - **PE-3f.** Inventories _[Assignment: organization-defined physical access devices]_ every _[Assignment: organization-defined frequency]_; and
      - **PE-3g.** Changes combinations and keys _[Assignment: organization-defined frequency]_ and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-3 (1):
  name: Information System Access
  family: Physical and Environmental Protection
  description: |
    The organization enforces physical access authorizations to the information system in addition to the physical access controls for the facility at _[Assignment: organization-defined physical spaces containing one or more components of the information system]_.
PE-3 (2):
  name: Facility / Information System Boundaries
  family: Physical and Environmental Protection
  description: |
    The organization performs security checks _[Assignment: organization-defined frequency]_ at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of information system components.
PE-3 (3):
  name: Continuous Guards / Alarms / Monitoring
  family: Physical and Environmental Protection
  description: |
    The organization employs guards and/or alarms to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.
PE-3 (4):
  name: Lockable Casings
  family: Physical and Environmental Protection
  description: |
    The organization uses lockable physical casings to protect _[Assignment: organization-defined information system components]_ from unauthorized physical access.
PE-3 (5):
  name: Tamper Protection
  family: Physical and Environmental Protection
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to [Selection (one or more): detect; prevent] physical tampering or alteration of _[Assignment: organization-defined hardware components]_ within the information system.
PE-3 (6):
  name: Facility Penetration Testing
  family: Physical and Environmental Protection
  description: |
    The organization employs a penetration testing process that includes _[Assignment: organization-defined frequency]_, unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility.
PE-4:
  name: Access Control for Transmission Medium
  family: Physical and Environmental Protection
  description: |
    The organization controls physical access to _[Assignment: organization-defined information system distribution and transmission lines]_ within organizational facilities using _[Assignment: organization-defined security safeguards]_.
PE-5:
  name: Access Control for Output Devices
  family: Physical and Environmental Protection
  description: |
    The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.
PE-5 (1):
  name: Access to Output by Authorized Individuals
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-5 (1)(a)** Controls physical access to output from _[Assignment: organization-defined output devices]_; and
      - **PE-5 (1)(b)** Ensures that only authorized individuals receive output from the device.
PE-5 (2):
  name: Access to Output by Individual Identity
  family: Physical and Environmental Protection
  description: |
    The information system:
      - **PE-5 (2)(a)** Controls physical access to output from _[Assignment: organization-defined output devices]_; and
      - **PE-5 (2)(b)** Links individual identity to receipt of the output from the device.
PE-5 (3):
  name: Marking Output Devices
  family: Physical and Environmental Protection
  description: |
    The organization marks _[Assignment: organization-defined information system output devices]_ indicating the appropriate security marking of the information permitted to be output from the device.
PE-6:
  name: Monitoring Physical Access
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-6a.** Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents;
      - **PE-6b.** Reviews physical access logs _[Assignment: organization-defined frequency]_ and upon occurrence of _[Assignment: organization-defined events or potential indications of events]_; and
      - **PE-6c.** Coordinates results of reviews and investigations with the organizational incident response capability.
PE-6 (1):
  name: Intrusion Alarms / Surveillance Equipment
  family: Physical and Environmental Protection
  description: |
    The organization monitors physical intrusion alarms and surveillance equipment.
PE-6 (2):
  name: Automated Intrusion Recognition / Responses
  family: Physical and Environmental Protection
  description: |
    The organization employs automated mechanisms to recognize _[Assignment: organization-defined classes/types of intrusions]_ and initiate _[Assignment: organization-defined response actions]_.
PE-6 (3):
  name: Video Surveillance
  family: Physical and Environmental Protection
  description: |
    The organization employs video surveillance of _[Assignment: organization-defined operational areas]_ and retains video recordings for _[Assignment: organization-defined time period]_.
PE-6 (4):
  name: Monitoring Physical Access to Information Systems
  family: Physical and Environmental Protection
  description: |
    The organization monitors physical access to the information system in addition to the physical access monitoring of the facility as _[Assignment: organization-defined physical spaces containing one or more components of the information system]_.
PE-7:
  name: Visitor Control
  family: Physical and Environmental Protection
  description: |
    _[Withdrawn: Incorporated into PE-2 and PE-3]_.
PE-8:
  name: Visitor Access Records
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-8a.** Maintains visitor access records to the facility where the information system resides for _[Assignment: organization-defined time period]_; and
      - **PE-8b.** Reviews visitor access records _[Assignment: organization-defined frequency]_.
PE-8 (1):
  name: Automated Records Maintenance / Review
  family: Physical and Environmental Protection
  description: |
    The organization employs automated mechanisms to facilitate the maintenance and review of visitor access records.
PE-8 (2):
  name: Physical Access Records
  family: Physical and Environmental Protection
  description: |
    _[Withdrawn: Incorporated into PE-2]_.
PE-9:
  name: Power Equipment and Cabling
  family: Physical and Environmental Protection
  description: |
    The organization protects power equipment and power cabling for the information system from damage and destruction.
PE-9 (1):
  name: Redundant Cabling
  family: Physical and Environmental Protection
  description: |
    The organization employs redundant power cabling paths that are physically separated by _[Assignment: organization-defined distance]_.
PE-9 (2):
  name: Automatic Voltage Controls
  family: Physical and Environmental Protection
  description: |
    The organization employs automatic voltage controls for _[Assignment: organization-defined critical information system components]_.
PE-10:
  name: Emergency Shutoff
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-10a.** Provides the capability of shutting off power to the information system or individual system components in emergency situations;
      - **PE-10b.** Places emergency shutoff switches or devices in _[Assignment: organization-defined location by information system or system component]_ to facilitate safe and easy access for personnel; and
      - **PE-10c.** Protects emergency power shutoff capability from unauthorized activation.
PE-10 (1):
  name: Accidental / Unauthorized Activation
  family: Physical and Environmental Protection
  description: |
    _[Withdrawn: Incorporated into PE-10]_.
PE-11:
  name: Emergency Power
  family: Physical and Environmental Protection
  description: |
    The organization provides a short-term uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the information system; transition of the information system to long-term alternate power] in the event of a primary power source loss.
PE-11 (1):
  name: Long-term Alternate Power Supply - Minimal Operational Capability
  family: Physical and Environmental Protection
  description: |
    The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability in the event of an extended loss of the primary power source.
PE-11 (2):
  name: Long-term Alternate Power Supply - Self-contained
  family: Physical and Environmental Protection
  description: |
    The organization provides a long-term alternate power supply for the information system that is:
      - **PE-11 (2)(a)** Self-contained;
      - **PE-11 (2)(b)** Not reliant on external power generation; and
      - **PE-11 (2)(c)** Capable of maintaining [Selection: minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source.
PE-12:
  name: Emergency Lighting
  family: Physical and Environmental Protection
  description: |
    The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
PE-12 (1):
  name: Essential Missions / Business Functions
  family: Physical and Environmental Protection
  description: |
    The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.
PE-13:
  name: Fire Protection
  family: Physical and Environmental Protection
  description: |
    The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.
PE-13 (1):
  name: Detection Devices / Systems
  family: Physical and Environmental Protection
  description: |
    The organization employs fire detection devices/systems for the information system that activate automatically and notify _[Assignment: organization-defined personnel or roles]_ and _[Assignment: organization-defined emergency responders]_ in the event of a fire.
PE-13 (2):
  name: Suppression Devices / Systems
  family: Physical and Environmental Protection
  description: |
    The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to Assignment: organization-defined personnel or roles] and _[Assignment: organization-defined emergency responders]_.
PE-13 (3):
  name: Automatic Fire Suppression
  family: Physical and Environmental Protection
  description: |
    The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.
PE-13 (4):
  name: Inspections
  family: Physical and Environmental Protection
  description: |
    The organization ensures that the facility undergoes _[Assignment: organization-defined frequency]_ inspections by authorized and qualified inspectors and resolves identified deficiencies within _[Assignment: organization-defined time period]_.
PE-14:
  name: Temperature and Humidity Controls
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-14a.** Maintains temperature and humidity levels within the facility where the information system resides at _[Assignment: organization-defined acceptable levels]_; and
      - **PE-14b.** Monitors temperature and humidity levels _[Assignment: organization-defined frequency]_.
PE-14 (1):
  name: Automatic Controls
  family: Physical and Environmental Protection
  description: |
    The organization employs automatic temperature and humidity controls in the facility to prevent fluctuations potentially harmful to the information system.
PE-14 (2):
  name: Monitoring With Alarms / Notifications
  family: Physical and Environmental Protection
  description: |
    The organization employs temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.
PE-15:
  name: Water Damage Protection
  family: Physical and Environmental Protection
  description: |
    The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
PE-15 (1):
  name: Automation Support
  family: Physical and Environmental Protection
  description: |
    The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts _[Assignment: organization-defined personnel or roles]_.
PE-16:
  name: Delivery and Removal
  family: Physical and Environmental Protection
  description: |
    The organization authorizes, monitors, and controls _[Assignment: organization-defined types of information system components]_ entering and exiting the facility and maintains records of those items.
PE-17:
  name: Alternate Work Site
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-17a.** Employs _[Assignment: organization-defined security controls]_ at alternate work sites;
      - **PE-17b.** Assesses as feasible, the effectiveness of security controls at alternate work sites; and
      - **PE-17c.** Provides a means for employees to communicate with information security personnel in case of security incidents or problems.
PE-18:
  name: Location of Information System Components
  family: Physical and Environmental Protection
  description: |
    The organization positions information system components within the facility to minimize potential damage from _[Assignment: organization-defined physical and environmental hazards]_ and to minimize the opportunity for unauthorized access.
PE-18 (1):
  name: Facility Site
  family: Physical and Environmental Protection
  description: |
    The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy.
PE-19:
  name: Information Leakage
  family: Physical and Environmental Protection
  description: |
    The organization protects the information system from information leakage due to electromagnetic signals emanations.
PE-19 (1):
  name: National Emissions / Tempest Policies and Procedures
  family: Physical and Environmental Protection
  description: |
    The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.
PE-20:
  name: Asset Monitoring and Tracking
  family: Physical and Environmental Protection
  description: |
    The organization:
      - **PE-20a.** Employs _[Assignment: organization-defined asset location technologies]_ to track and monitor the location and movement of _[Assignment: organization-defined assets]_ within _[Assignment: organization-defined controlled areas]_; and
      - **PE-20b.** Ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.
PL-1:
  name: Security Planning Policy and Procedures
  family: Planning
  description: |
    The organization:
      - **PL-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **PL-1a.1.** A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **PL-1a.2.** Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and
      - **PL-1b.** Reviews and updates the current:
        - **PL-1b.1.** Security planning policy _[Assignment: organization-defined frequency]_; and
        - **PL-1b.2.** Security planning procedures _[Assignment: organization-defined frequency]_.
PL-2:
  name: System Security Plan
  family: Planning
  description: |
    The organization:
      - **PL-2a.** Develops a security plan for the information system that:
        - **PL-2a.1.** Is consistent with the organization's enterprise architecture;
        - **PL-2a.2.** Explicitly defines the authorization boundary for the system;
        - **PL-2a.3.** Describes the operational context of the information system in terms of missions and business processes;
        - **PL-2a.4.** Provides the security categorization of the information system including supporting rationale;
        - **PL-2a.5.** Describes the operational environment for the information system and relationships with or connections to other information systems;
        - **PL-2a.6.** Provides an overview of the security requirements for the system;
        - **PL-2a.7.** Identifies any relevant overlays, if applicable;
        - **PL-2a.8.** Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and
        - **PL-2a.9.** Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;
      - **PL-2b.** Distributes copies of the security plan and communicates subsequent changes to the plan to _[Assignment: organization-defined personnel or roles]_;
      - **PL-2c.** Reviews the security plan for the information system _[Assignment: organization-defined frequency]_;
      - **PL-2d.** Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and
      - **PL-2e.** Protects the security plan from unauthorized disclosure and modification.
PL-2 (1):
  name: Concept of Operations
  family: Planning
  description: |
    _[Withdrawn: Incorporated into PL-7]_.
PL-2 (2):
  name: Functional Architecture
  family: Planning
  description: |
    _[Withdrawn: Incorporated into PL-8]_.
PL-2 (3):
  name: Plan / Coordinate With Other Organizational Entities
  family: Planning
  description: |
    The organization plans and coordinates security-related activities affecting the information system with _[Assignment: organization-defined individuals or groups]_ before conducting such activities in order to reduce the impact on other organizational entities.
PL-3:
  name: System Security Plan Update
  family: Planning
  description: |
    _[Withdrawn: Incorporated into PL-2]_.
PL-4:
  name: Rules of Behavior
  family: Planning
  description: |
    The organization:
      - **PL-4a.** Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;
      - **PL-4b.** Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;
      - **PL-4c.** Reviews and updates the rules of behavior _[Assignment: organization-defined frequency]_; and
      - **PL-4d.** Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.
PL-4 (1):
  name: Social Media and Networking Restrictions
  family: Planning
  description: |
    The organization includes in the rules of behavior, explicit restrictions on the use of social media/networking sites and posting organizational information on public websites.
PL-5:
  name: Privacy Impact Assessment
  family: Planning
  description: |
    _[Withdrawn: Incorporated into Appendix J, AR-2]_.
PL-6:
  name: Security-related Activity Planning
  family: Planning
  description: |
    _[Withdrawn: Incorporated into PL-2]_.
PL-7:
  name: Security Concept of Operations
  family: Planning
  description: |
    The organization:
      - **PL-7a.** Develops a security Concept of Operations (CONOPS) for the information system containing at a minimum, how the organization intends to operate the system from the perspective of information security; and
      - **PL-7b.** Reviews and updates the CONOPS _[Assignment: organization-defined frequency]_.
PL-8:
  name: Information Security Architecture
  family: Planning
  description: |
    The organization:
      - **PL-8a.** Develops an information security architecture for the information system that:
        - **PL-8a.1.** Describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information;
        - **PL-8a.2.** Describes how the information security architecture is integrated into and supports the enterprise architecture; and
        - **PL-8a.3.** Describes any information security assumptions about, and dependencies on, external services;
      - **PL-8b.** Reviews and updates the information security architecture _[Assignment: organization-defined frequency]_ to reflect updates in the enterprise architecture; and
      - **PL-8c.** Ensures that planned information security architecture changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.
PL-8 (1):
  name: Defense-in-depth
  family: Planning
  description: |
    The organization designs its security architecture using a defense-in-depth approach that:
      - **PL-8 (1)(a)** Allocates _[Assignment: organization-defined security safeguards]_ to _[Assignment: organization-defined locations and architectural layers]_; and
      - **PL-8 (1)(b)** Ensures that the allocated security safeguards operate in a coordinated and mutually reinforcing manner.
PL-8 (2):
  name: Supplier Diversity
  family: Planning
  description: |
    The organization requires that _[Assignment: organization-defined security safeguards]_ allocated to _[Assignment: organization-defined locations and architectural layers]_ are obtained from different suppliers.
PL-9:
  name: Central Management
  family: Planning
  description: |
    The organization centrally manages _[Assignment: organization-defined security controls and related processes]_.
PS-1:
  name: Personnel Security Policy and Procedures
  family: Personnel Security
  description: |
    The organization:
      - **PS-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **PS-1a.1.** A personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **PS-1a.2.** Procedures to facilitate the implementation of the personnel security policy and associated personnel security controls; and
      - **PS-1b.** Reviews and updates the current:
        - **PS-1b.1.** Personnel security policy _[Assignment: organization-defined frequency]_; and
        - **PS-1b.2.** Personnel security procedures _[Assignment: organization-defined frequency]_.
PS-2:
  name: Position Risk Designation
  family: Personnel Security
  description: |
    The organization:
      - **PS-2a.** Assigns a risk designation to all organizational positions;
      - **PS-2b.** Establishes screening criteria for individuals filling those positions; and
      - **PS-2c.** Reviews and updates position risk designations _[Assignment: organization-defined frequency]_.
PS-3:
  name: Personnel Screening
  family: Personnel Security
  description: |
    The organization:
      - **PS-3a.** Screens individuals prior to authorizing access to the information system; and
      - **PS-3b.** Rescreens individuals according to _[Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening]_.
PS-3 (1):
  name: Classified Information
  family: Personnel Security
  description: |
    The organization ensures that individuals accessing an information system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.
PS-3 (2):
  name: Formal Indoctrination
  family: Personnel Security
  description: |
    The organization ensures that individuals accessing an information system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.
PS-3 (3):
  name: Information With Special Protection Measures
  family: Personnel Security
  description: |
    The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection:
      - **PS-3 (3)(a)** Have valid access authorizations that are demonstrated by assigned official government duties; and
      - **PS-3 (3)(b)** Satisfy _[Assignment: organization-defined additional personnel screening criteria]_.
PS-4:
  name: Personnel Termination
  family: Personnel Security
  description: |
    The organization, upon termination of individual employment:
      - **PS-4a.** Disables information system access within _[Assignment: organization-defined time period]_;
      - **PS-4b.** Terminates/revokes any authenticators/credentials associated with the individual;
      - **PS-4c.** Conducts exit interviews that include a discussion of _[Assignment: organization-defined information security topics]_;
      - **PS-4d.** Retrieves all security-related organizational information system-related property;
      - **PS-4e.** Retains access to organizational information and information systems formerly controlled by terminated individual; and
      - **PS-4f.** Notifies _[Assignment: organization-defined personnel or roles]_ within _[Assignment: organization-defined time period]_.
PS-4 (1):
  name: Post-employment Requirements
  family: Personnel Security
  description: |
    The organization:
      - **PS-4 (1)(a)** Notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and
      - **PS-4 (1)(b)** Requires terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
PS-4 (2):
  name: Automated Notification
  family: Personnel Security
  description: |
    The organization employs automated mechanisms to notify _[Assignment: organization-defined personnel or roles]_ upon termination of an individual.
PS-5:
  name: Personnel Transfer
  family: Personnel Security
  description: |
    The organization:
      - **PS-5a.** Reviews and confirms ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization;
      - **PS-5b.** Initiates _[Assignment: organization-defined transfer or reassignment actions]_ within _[Assignment: organization-defined time period following the formal transfer action]_;
      - **PS-5c.** Modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and
      - **PS-5d.** Notifies _[Assignment: organization-defined personnel or roles]_ within _[Assignment: organization-defined time period]_.
PS-6:
  name: Access Agreements
  family: Personnel Security
  description: |
    The organization:
      - **PS-6a.** Develops and documents access agreements for organizational information systems;
      - **PS-6b.** Reviews and updates the access agreements _[Assignment: organization-defined frequency]_; and
      - **PS-6c.** Ensures that individuals requiring access to organizational information and information systems:
        - **PS-6c.1.** Sign appropriate access agreements prior to being granted access; and
        - **PS-6c.2.** Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or _[Assignment: organization-defined frequency]_.
PS-6 (1):
  name: Information Requiring Special Protection
  family: Personnel Security
  description: |
    _[Withdrawn: Incorporated into PS-3]_.
PS-6 (2):
  name: Classified Information Requiring Special Protection
  family: Personnel Security
  description: |
    The organization ensures that access to classified information requiring special protection is granted only to individuals who:
      - **PS-6 (2)(a)** Have a valid access authorization that is demonstrated by assigned official government duties;
      - **PS-6 (2)(b)** Satisfy associated personnel security criteria; and
      - **PS-6 (2)(c)** Have read, understood, and signed a nondisclosure agreement.
PS-6 (3):
  name: Post-employment Requirements
  family: Personnel Security
  description: |
    The organization:
      - **PS-6 (3)(a)** Notifies individuals of applicable, legally binding post-employment requirements for protection of organizational information; and
      - **PS-6 (3)(b)** Requires individuals to sign an acknowledgment of these requirements, if applicable, as part of granting initial access to covered information.
PS-7:
  name: Third-party Personnel Security
  family: Personnel Security
  description: |
    The organization:
      - **PS-7a.** Establishes personnel security requirements including security roles and responsibilities for third-party providers;
      - **PS-7b.** Requires third-party providers to comply with personnel security policies and procedures established by the organization;
      - **PS-7c.** Documents personnel security requirements;
      - **PS-7d.** Requires third-party providers to notify _[Assignment: organization-defined personnel or roles]_ of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within _[Assignment: organization-defined time period]_; and
      - **PS-7e.** Monitors provider compliance.
PS-8:
  name: Personnel Sanctions
  family: Personnel Security
  description: |
    The organization:
      - **PS-8a.** Employs a formal sanctions process for individuals failing to comply with established information security policies and procedures; and
      - **PS-8b.** Notifies _[Assignment: organization-defined personnel or roles]_ within _[Assignment: organization-defined time period]_ when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
RA-1:
  name: Risk Assessment Policy and Procedures
  family: Risk Assessment
  description: |
    The organization:
      - **RA-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **RA-1a.1.** A risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **RA-1a.2.** Procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls; and
      - **RA-1b.** Reviews and updates the current:
        - **RA-1b.1.** Risk assessment policy _[Assignment: organization-defined frequency]_; and
        - **RA-1b.2.** Risk assessment procedures _[Assignment: organization-defined frequency]_.
RA-2:
  name: Security Categorization
  family: Risk Assessment
  description: |
    The organization:
      - **RA-2a.** Categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;
      - **RA-2b.** Documents the security categorization results (including supporting rationale) in the security plan for the information system; and
      - **RA-2c.** Ensures that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
RA-3:
  name: Risk Assessment
  family: Risk Assessment
  description: |
    The organization:
      - **RA-3a.** Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits;
      - **RA-3b.** Documents risk assessment results in [Selection: security plan; risk assessment report; _[Assignment: organization-defined document]_];
      - **RA-3c.** Reviews risk assessment results _[Assignment: organization-defined frequency]_;
      - **RA-3d.** Disseminates risk assessment results to _[Assignment: organization-defined personnel or roles]_; and
      - **RA-3e.** Updates the risk assessment _[Assignment: organization-defined frequency]_ or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.
RA-4:
  name: Risk Assessment Update
  family: Risk Assessment
  description: |
    _[Withdrawn: Incorporated into RA-3]_.
RA-5:
  name: Vulnerability Scanning
  family: Risk Assessment
  description: |
    The organization:
      - **RA-5a.** Scans for vulnerabilities in the information system and hosted applications _[Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process]_ and when new vulnerabilities potentially affecting the system/applications are identified and reported;
      - **RA-5b.** Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
        - **RA-5b.1.** Enumerating platforms, software flaws, and improper configurations;
        - **RA-5b.2.** Formatting checklists and test procedures; and
        - **RA-5b.3.** Measuring vulnerability impact;
      - **RA-5c.** Analyzes vulnerability scan reports and results from security control assessments;
      - **RA-5d.** Remediates legitimate vulnerabilities _[Assignment: organization-defined response times]_ in accordance with an organizational assessment of risk; and
      - **RA-5e.** Shares information obtained from the vulnerability scanning process and security control assessments with _[Assignment: organization-defined personnel or roles]_ to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
RA-5 (1):
  name: Update Tool Capability
  family: Risk Assessment
  description: |
    The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.
RA-5 (2):
  name: Update by Frequency / Prior to New Scan / When Identified
  family: Risk Assessment
  description: |
    The organization updates the information system vulnerabilities scanned [Selection (one or more): _[Assignment: organization-defined frequency]_; prior to a new scan; when new vulnerabilities are identified and reported].
RA-5 (3):
  name: Breadth / Depth of Coverage
  family: Risk Assessment
  description: |
    The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).
RA-5 (4):
  name: Discoverable Information
  family: Risk Assessment
  description: |
    The organization determines what information about the information system is discoverable by adversaries and subsequently takes _[Assignment: organization-defined corrective actions]_.
RA-5 (5):
  name: Privileged Access
  family: Risk Assessment
  description: |
    The information system implements privileged access authorization to _[Assignment: organization-identified information system components]_ for selected _[Assignment: organization-defined vulnerability scanning activities]_.
RA-5 (6):
  name: Automated Trend Analyses
  family: Risk Assessment
  description: |
    The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.
RA-5 (7):
  name: Automated Detection and Notification of Unauthorized Components
  family: Risk Assessment
  description: |
    _[Withdrawn: Incorporated into CM-8]_.
RA-5 (8):
  name: Review Historic Audit Logs
  family: Risk Assessment
  description: |
    The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
RA-5 (9):
  name: Penetration Testing and Analyses
  family: Risk Assessment
  description: |
    _[Withdrawn: Incorporated into CA-8]_.
RA-5 (10):
  name: Correlate Scanning Information
  family: Risk Assessment
  description: |
    The organization correlates the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.
RA-6:
  name: Technical Surveillance Countermeasures Survey
  family: Risk Assessment
  description: |
    The organization employs a technical surveillance countermeasures survey at _[Assignment: organization-defined locations]_ [Selection (one or more): _[Assignment: organization-defined frequency]_; _[Assignment: organization-defined events or indicators occur]_].
SA-1:
  name: System and Services Acquisition Policy and Procedures
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **SA-1a.1.** A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **SA-1a.2.** Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and
      - **SA-1b.** Reviews and updates the current:
        - **SA-1b.1.** System and services acquisition policy _[Assignment: organization-defined frequency]_; and
        - **SA-1b.2.** System and services acquisition procedures _[Assignment: organization-defined frequency]_.
SA-2:
  name: Allocation of Resources
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-2a.** Determines information security requirements for the information system or information system service in mission/business process planning;
      - **SA-2b.** Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and
      - **SA-2c.** Establishes a discrete line item for information security in organizational programming and budgeting documentation.
SA-3:
  name: System Development Life Cycle
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-3a.** Manages the information system using _[Assignment: organization-defined system development life cycle]_ that incorporates information security considerations;
      - **SA-3b.** Defines and documents information security roles and responsibilities throughout the system development life cycle;
      - **SA-3c.** Identifies individuals having information security roles and responsibilities; and
      - **SA-3d.** Integrates the organizational information security risk management process into system development life cycle activities.
SA-4:
  name: Acquisition Process
  family: System and Services Acquisition
  description: |
    The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs:
      - **SA-4a.** Security functional requirements;
      - **SA-4b.** Security strength requirements;
      - **SA-4c.** Security assurance requirements;
      - **SA-4d.** Security-related documentation requirements;
      - **SA-4e.** Requirements for protecting security-related documentation;
      - **SA-4f.** Description of the information system development environment and environment in which the system is intended to operate; and
      - **SA-4g.** Acceptance criteria.
SA-4 (1):
  name: Functional Properties of Security Controls
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.
SA-4 (2):
  name: Design / Implementation Information for Security Controls
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; _[Assignment: organization-defined design/implementation information]_] at _[Assignment: organization-defined level of detail]_.
SA-4 (3):
  name: Development Methods / Techniques / Practices
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes _[Assignment: organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes]_.
SA-4 (4):
  name: Assignment of Components to Systems
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into CM-8 (9)]_.
SA-4 (5):
  name: System / Component / Service Configurations
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-4 (5)(a)** Deliver the system, component, or service with _[Assignment: organization-defined security configurations]_ implemented; and
      - **SA-4 (5)(b)** Use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.
SA-4 (6):
  name: Use of Information Assurance Products
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-4 (6)(a)** Employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and
      - **SA-4 (6)(b)** Ensures that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.
SA-4 (7):
  name: Niap-approved  Protection Profiles
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-4 (7)(a)** Limits the use of commercially provided information assurance (IA) and IA-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
      - **SA-4 (7)(b)** Requires, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated.
SA-4 (8):
  name: Continuous Monitoring Plan
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains _[Assignment: organization-defined level of detail]_.
SA-4 (9):
  name: Functions / Ports / Protocols / Services in Use
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.
SA-4 (10):
  name: Use of Approved Piv Products
  family: System and Services Acquisition
  description: |
    The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.
SA-5:
  name: Information System Documentation
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-5a.** Obtains administrator documentation for the information system, system component, or information system service that describes:
        - **SA-5a.1.** Secure configuration, installation, and operation of the system, component, or service;
        - **SA-5a.2.** Effective use and maintenance of security functions/mechanisms; and
        - **SA-5a.3.** Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;
      - **SA-5b.** Obtains user documentation for the information system, system component, or information system service that describes:
        - **SA-5b.1.** User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;
        - **SA-5b.2.** Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and
        - **SA-5b.3.** User responsibilities in maintaining the security of the system, component, or service;
      - **SA-5c.** Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and takes _[Assignment: organization-defined actions]_ in response;
      - **SA-5d.** Protects documentation as required, in accordance with the risk management strategy; and
      - **SA-5e.** Distributes documentation to _[Assignment: organization-defined personnel or roles]_.
SA-5 (1):
  name: Functional Properties of Security Controls
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-4 (1)]_.
SA-5 (2):
  name: Security-relevant External System Interfaces
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-4 (2)]_.
SA-5 (3):
  name: High-level Design
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-4 (2)]_.
SA-5 (4):
  name: Low-level Design
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-4 (2)]_.
SA-5 (5):
  name: Source Code
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-4 (2)]_.
SA-6:
  name: Software Usage Restrictions
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into CM-10 and SI-7]_.
SA-7:
  name: User-installed Software
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into CM-11 and SI-7]_.
SA-8:
  name: Security Engineering Principles
  family: System and Services Acquisition
  description: |
    The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.
SA-9:
  name: External Information System Services
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-9a.** Requires that providers of external information system services comply with organizational information security requirements and employ _[Assignment: organization-defined security controls]_ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;
      - **SA-9b.** Defines and documents government oversight and user roles and responsibilities with regard  to external information system services; and
      - **SA-9c.** Employs _[Assignment: organization-defined processes, methods, and techniques]_ to monitor security control compliance by external service providers on an ongoing basis.
SA-9 (1):
  name: Risk Assessments / Organizational Approvals
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-9 (1)(a)** Conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services; and
      - **SA-9 (1)(b)** Ensures that the acquisition or outsourcing of dedicated information security services is approved by _[Assignment: organization-defined personnel or roles]_.
SA-9 (2):
  name: Identification of Functions / Ports / Protocols / Services
  family: System and Services Acquisition
  description: |
    The organization requires providers of _[Assignment: organization-defined external information system services]_ to identify the functions, ports, protocols, and other services required for the use of such services.
SA-9 (3):
  name: Establish / Maintain Trust Relationship With Providers
  family: System and Services Acquisition
  description: |
    The organization establishes, documents, and maintains trust relationships with external service providers based on _[Assignment: organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships]_.
SA-9 (4):
  name: Consistent Interests of Consumers and Providers
  family: System and Services Acquisition
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to ensure that the interests of _[Assignment: organization-defined external service providers]_ are consistent with and reflect organizational interests.
SA-9 (5):
  name: Processing, Storage, and Service Location
  family: System and Services Acquisition
  description: |
    The organization restricts the location of [Selection (one or more): information processing; information/data; information system services] to _[Assignment: organization-defined locations]_ based on _[Assignment: organization-defined requirements or conditions]_.
SA-10:
  name: Developer Configuration Management
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-10a.** Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation];
      - **SA-10b.** Document, manage, and control the integrity of changes to _[Assignment: organization-defined configuration items under configuration management]_;
      - **SA-10c.** Implement only organization-approved changes to the system, component, or service;
      - **SA-10d.** Document approved changes to the system, component, or service and the potential security impacts of such changes; and
      - **SA-10e.** Track security flaws and flaw resolution within the system, component, or service and report findings to _[Assignment: organization-defined personnel]_.
SA-10 (1):
  name: Software / Firmware Integrity Verification
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.
SA-10 (2):
  name: Alternative Configuration Management Processes
  family: System and Services Acquisition
  description: |
    The organization provides an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
SA-10 (3):
  name: Hardware Integrity Verification
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to enable integrity verification of hardware components.
SA-10 (4):
  name: Trusted Generation
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions and software/firmware source and object code with previous versions.
SA-10 (5):
  name: Mapping Integrity for Version Control
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to maintain the integrity of the mapping between the  master build data (hardware drawings and software/firmware code) describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.
SA-10 (6):
  name: Trusted Distribution
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.
SA-11:
  name: Developer Security Testing and Evaluation
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-11a.** Create and implement a security assessment plan;
      - **SA-11b.** Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at _[Assignment: organization-defined depth and coverage]_;
      - **SA-11c.** Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation;
      - **SA-11d.** Implement a verifiable flaw remediation process; and
      - **SA-11e.** Correct flaws identified during security testing/evaluation.
SA-11 (1):
  name: Static Code Analysis
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws and document the results of the analysis.
SA-11 (2):
  name: Threat and Vulnerability Analyses
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analyses and subsequent testing/evaluation of the as-built system, component, or service.
SA-11 (3):
  name: Independent Verification of Assessment Plans / Evidence
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-11 (3)(a)** Requires an independent agent satisfying _[Assignment: organization-defined independence criteria]_ to verify the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation; and
      - **SA-11 (3)(b)** Ensures that the independent agent is either provided with sufficient information to complete the verification process or granted the authority to obtain such information.
SA-11 (4):
  name: Manual Code Reviews
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to perform a manual code review of _[Assignment: organization-defined specific code]_ using _[Assignment: organization-defined processes, procedures, and/or techniques]_.
SA-11 (5):
  name: Penetration Testing
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to perform penetration testing at _[Assignment: organization-defined breadth/depth]_ and with _[Assignment: organization-defined constraints]_.
SA-11 (6):
  name: Attack Surface Reviews
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to perform attack surface reviews.
SA-11 (7):
  name: Verify Scope of Testing / Evaluation
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to verify that the scope of security testing/evaluation provides complete coverage of required security controls at _[Assignment: organization-defined depth of testing/evaluation]_.
SA-11 (8):
  name: Dynamic Code Analysis
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.
SA-12:
  name: Supply Chain Protection
  family: System and Services Acquisition
  description: |
    The organization protects against supply chain threats to the information system, system component, or information system service by employing _[Assignment: organization-defined security safeguards]_ as part of a comprehensive, defense-in-breadth information security strategy.
SA-12 (1):
  name: Acquisition Strategies / Tools / Methods
  family: System and Services Acquisition
  description: |
    The organization employs _[Assignment: organization-defined tailored acquisition strategies, contract tools, and procurement methods]_ for the purchase of the information system, system component, or information system service from suppliers.
SA-12 (2):
  name: Supplier Reviews
  family: System and Services Acquisition
  description: |
    The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.
SA-12 (3):
  name: Trusted Shipping and Warehousing
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-12 (1)]_.
SA-12 (4):
  name: Diversity of Suppliers
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-12 (13)]_.
SA-12 (5):
  name: Limitation of Harm
  family: System and Services Acquisition
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to limit harm from potential adversaries identifying and targeting the organizational supply chain.
SA-12 (6):
  name: Minimizing Procurement Time
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-12 (1)]_.
SA-12 (7):
  name: Assessments Prior to Selection / Acceptance / Update
  family: System and Services Acquisition
  description: |
    The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.
SA-12 (8):
  name: Use of All-source Intelligence
  family: System and Services Acquisition
  description: |
    The organization uses all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.
SA-12 (9):
  name: Operations Security
  family: System and Services Acquisition
  description: |
    The organization employs _[Assignment: organization-defined Operations Security (OPSEC) safeguards]_ in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.
SA-12 (10):
  name: Validate As Genuine and Not Altered
  family: System and Services Acquisition
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to validate that the information system or system component received is genuine and has not been altered.
SA-12 (11):
  name: Penetration Testing / Analysis of Elements, Processes, and Actors
  family: System and Services Acquisition
  description: |
    The organization employs [Selection (one or more): organizational analysis, independent third-party analysis, organizational penetration testing, independent third-party penetration testing] of _[Assignment: organization-defined supply chain elements, processes, and actors]_ associated with the information system, system component, or information system service.
SA-12 (12):
  name: Inter-organizational Agreements
  family: System and Services Acquisition
  description: |
    The organization establishes inter-organizational agreements and procedures with entities involved in the supply chain for the information system, system component, or information system service.
SA-12 (13):
  name: Critical Information System Components
  family: System and Services Acquisition
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to ensure an adequate supply of _[Assignment: organization-defined critical information system components]_.
SA-12 (14):
  name: Identity and Traceability
  family: System and Services Acquisition
  description: |
    The organization establishes and retains unique identification of _[Assignment: organization-defined supply chain elements, processes, and actors]_ for the information system, system component, or information system service.
SA-12 (15):
  name: Processes to Address Weaknesses or Deficiencies
  family: System and Services Acquisition
  description: |
    The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.
SA-13:
  name: Trustworthiness
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-13a.** Describes the trustworthiness required in the _[Assignment: organization-defined information system, information system component, or information system service]_ supporting its critical missions/business functions; and
      - **SA-13b.** Implements _[Assignment: organization-defined assurance overlay]_ to achieve such trustworthiness.
SA-14:
  name: Criticality Analysis
  family: System and Services Acquisition
  description: |
    The organization identifies critical information system components and functions by performing a criticality analysis for _[Assignment: organization-defined information systems, information system components, or information system services]_ at _[Assignment: organization-defined decision points in the system development life cycle]_.
SA-14 (1):
  name: Critical Components With  No Viable Alternative Sourcing
  family: System and Services Acquisition
  description: |
    _[Withdrawn: Incorporated into SA-20]_.
SA-15:
  name: Development Process, Standards, and Tools
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-15a.** Requires the developer of the information system, system component, or information system service to follow a documented development process that:
        - **SA-15a.1.** Explicitly addresses security requirements;
        - **SA-15a.2.** Identifies the standards and tools used in the development process;
        - **SA-15a.3.** Documents the specific tool options and tool configurations used in the development process; and
        - **SA-15a.4.** Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and
      - **SA-15b.** Reviews the development process, standards, tools, and tool options/configurations _[Assignment: organization-defined frequency]_ to determine if the process, standards, tools, and tool options/configurations selected and employed can satisfy _[Assignment: organization-defined security requirements]_.
SA-15 (1):
  name: Quality Metrics
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-15 (1)(a)** Define quality metrics at the beginning of the development process; and
      - **SA-15 (1)(b)** Provide evidence of meeting the quality metrics [Selection (one or more): _[Assignment: organization-defined frequency]_; _[Assignment: organization-defined program review milestones]_; upon delivery].
SA-15 (2):
  name: Security Tracking Tools
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to select and employ a security tracking tool for use during the development process.
SA-15 (3):
  name: Criticality Analysis
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at _[Assignment: organization-defined breadth/depth]_ and at _[Assignment: organization-defined decision points in the system development life cycle]_.
SA-15 (4):
  name: Threat Modeling / Vulnerability Analysis
  family: System and Services Acquisition
  description: |
    The organization requires that developers perform threat modeling and a vulnerability analysis for the information system at _[Assignment: organization-defined breadth/depth]_ that:
      - **SA-15 (4)(a)** Uses _[Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels]_;
      - **SA-15 (4)(b)** Employs _[Assignment: organization-defined tools and methods]_; and
      - **SA-15 (4)(c)** Produces evidence that meets _[Assignment: organization-defined acceptance criteria]_.
SA-15 (5):
  name: Attack Surface Reduction
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to reduce attack surfaces to _[Assignment: organization-defined thresholds]_.
SA-15 (6):
  name: Continuous Improvement
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to implement an explicit process to continuously improve the development process.
SA-15 (7):
  name: Automated Vulnerability Analysis
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-15 (7)(a)** Perform an automated vulnerability analysis using _[Assignment: organization-defined tools]_;
      - **SA-15 (7)(b)** Determine the exploitation potential for discovered vulnerabilities;
      - **SA-15 (7)(c)** Determine potential risk mitigations for delivered vulnerabilities; and
      - **SA-15 (7)(d)** Deliver the outputs of the tools and results of the analysis to _[Assignment: organization-defined personnel or roles]_.
SA-15 (8):
  name: Reuse of Threat / Vulnerability Information
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.
SA-15 (9):
  name: Use of Live Data
  family: System and Services Acquisition
  description: |
    The organization approves, documents, and controls the use of live data in development and test environments for the information system, system component, or information system service.
SA-15 (10):
  name: Incident Response Plan
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to provide an incident response plan.
SA-15 (11):
  name: Archive Information System / Component
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.
SA-16:
  name: Developer-provided Training
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to provide _[Assignment: organization-defined training]_ on the correct use and operation of the implemented security functions, controls, and/or mechanisms.
SA-17:
  name: Developer Security Architecture and Design
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to produce a design specification and security architecture that:
      - **SA-17a.** Is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture;
      - **SA-17b.** Accurately and completely describes the required security functionality, and the allocation of security controls among physical and logical components; and
      - **SA-17c.** Expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.
SA-17 (1):
  name: Formal Policy Model
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-17 (1)(a)** Produce, as an integral part of the development process, a formal policy model describing the _[Assignment: organization-defined elements of organizational security policy]_ to be enforced; and
      - **SA-17 (1)(b)** Prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.
SA-17 (2):
  name: Security-relevant Components
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-17 (2)(a)** Define security-relevant hardware, software, and firmware; and
      - **SA-17 (2)(b)** Provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.
SA-17 (3):
  name: Formal Correspondence
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-17 (3)(a)** Produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects;
      - **SA-17 (3)(b)** Show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model;
      - **SA-17 (3)(c)** Show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;
      - **SA-17 (3)(d)** Show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware; and
      - **SA-17 (3)(e)** Describe the security-relevant hardware, software, and firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware, software, and firmware.
SA-17 (4):
  name: Informal Correspondence
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-17 (4)(a)** Produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects;
      - **SA-17 (4)(b)** Show via [Selection: informal demonstration, convincing argument with formal methods as feasible] that the descriptive top-level specification is consistent with the formal policy model;
      - **SA-17 (4)(c)** Show via informal demonstration, that the descriptive top-level specification completely  covers the interfaces to security-relevant hardware, software, and firmware;
      - **SA-17 (4)(d)** Show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware; and
      - **SA-17 (4)(e)** Describe the security-relevant hardware, software, and firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware, software, and firmware.
SA-17 (5):
  name: Conceptually Simple Design
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to:
      - **SA-17 (5)(a)** Design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics; and
      - **SA-17 (5)(b)** Internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.
SA-17 (6):
  name: Structure for Testing
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to structure security-relevant hardware, software, and firmware to facilitate testing.
SA-17 (7):
  name: Structure for Least Privilege
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.
SA-18:
  name: Tamper Resistance and Detection
  family: System and Services Acquisition
  description: |
    The organization implements a tamper protection program for the information system, system component, or information system service.
SA-18 (1):
  name: Multiple Phases of Sdlc
  family: System and Services Acquisition
  description: |
    The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design, development, integration, operations, and maintenance.
SA-18 (2):
  name: Inspection of Information Systems, Components, or Devices
  family: System and Services Acquisition
  description: |
    The organization inspects _[Assignment: organization-defined information systems, system components, or devices]_ [Selection (one or more): at random; at _[Assignment: organization-defined frequency]_, upon _[Assignment: organization-defined indications of need for inspection]_] to detect tampering.
SA-19:
  name: Component Authenticity
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-19a.** Develops and implements anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the information system; and
      - **SA-19b.** Reports counterfeit information system components to [Selection (one or more): source of counterfeit component; _[Assignment: organization-defined external reporting organizations]_; _[Assignment: organization-defined personnel or roles]_].
SA-19 (1):
  name: Anti-counterfeit Training
  family: System and Services Acquisition
  description: |
    The organization trains _[Assignment: organization-defined personnel or roles]_ to detect counterfeit information system components (including hardware, software, and firmware).
SA-19 (2):
  name: Configuration Control for Component Service / Repair
  family: System and Services Acquisition
  description: |
    The organization maintains configuration control over _[Assignment: organization-defined information system components]_ awaiting service/repair and serviced/repaired components awaiting return to service.
SA-19 (3):
  name: Component Disposal
  family: System and Services Acquisition
  description: |
    The organization disposes of information system components using _[Assignment: organization-defined techniques and methods]_.
SA-19 (4):
  name: Anti-counterfeit Scanning
  family: System and Services Acquisition
  description: |
    The organization scans for counterfeit information system components _[Assignment: organization-defined frequency]_.
SA-20:
  name: Customized Development of Critical Components
  family: System and Services Acquisition
  description: |
    The organization re-implements or custom develops _[Assignment: organization-defined critical information system components]_.
SA-21:
  name: Developer Screening
  family: System and Services Acquisition
  description: |
    The organization requires that the developer of _[Assignment: organization-defined information system, system component, or information system service]_:
      - **SA-21a.** Have appropriate access authorizations as determined by assigned _[Assignment: organization-defined official government duties]_; and
      - **SA-21b.** Satisfy _[Assignment: organization-defined additional personnel screening criteria]_.
SA-21 (1):
  name: Validation of Screening
  family: System and Services Acquisition
  description: |
    The organization requires the developer of the information system, system component, or information system service take _[Assignment: organization-defined actions]_ to ensure that the required access authorizations and screening criteria are satisfied.
SA-22:
  name: Unsupported System Components
  family: System and Services Acquisition
  description: |
    The organization:
      - **SA-22a.** Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and
      - **SA-22b.** Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.
SA-22 (1):
  name: Alternative Sources for Continued Support
  family: System and Services Acquisition
  description: |
    The organization provides [Selection (one or more): in-house support; _[Assignment: organization-defined support from external providers]_] for unsupported information system components.
SC-1:
  name: System and Communications Protection Policy and Procedures
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **SC-1a.1.** A system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **SC-1a.2.** Procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls; and
      - **SC-1b.** Reviews and updates the current:
        - **SC-1b.1.** System and communications protection policy _[Assignment: organization-defined frequency]_; and
        - **SC-1b.2.** System and communications protection procedures _[Assignment: organization-defined frequency]_.
SC-2:
  name: Application Partitioning
  family: System and Communications Protection
  description: |
    The information system separates user functionality (including user interface services) from information system management functionality.
SC-2 (1):
  name: Interfaces for Non-privileged Users
  family: System and Communications Protection
  description: |
    The information system prevents the presentation of information system management-related functionality at an interface for non-privileged users.
SC-3:
  name: Security Function Isolation
  family: System and Communications Protection
  description: |
    The information system isolates security functions from nonsecurity functions.
SC-3 (1):
  name: Hardware Separation
  family: System and Communications Protection
  description: |
    The information system utilizes underlying hardware separation mechanisms to implement security function isolation.
SC-3 (2):
  name: Access / Flow Control Functions
  family: System and Communications Protection
  description: |
    The information system isolates security functions enforcing access and information flow control from nonsecurity functions and from other security functions.
SC-3 (3):
  name: Minimize Nonsecurity Functionality
  family: System and Communications Protection
  description: |
    The organization minimizes the number of nonsecurity functions included within the isolation boundary containing security functions.
SC-3 (4):
  name: Module Coupling and Cohesiveness
  family: System and Communications Protection
  description: |
    The organization implements security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.
SC-3 (5):
  name: Layered Structures
  family: System and Communications Protection
  description: |
    The organization implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
SC-4:
  name: Information in Shared Resources
  family: System and Communications Protection
  description: |
    The information system prevents unauthorized and unintended information transfer via shared system resources.
SC-4 (1):
  name: Security Levels
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-4]_.
SC-4 (2):
  name: Periods Processing
  family: System and Communications Protection
  description: |
    The information system prevents unauthorized information transfer via shared resources in accordance with _[Assignment: organization-defined procedures]_ when system processing explicitly switches between different information classification levels or security categories.
SC-5:
  name: Denial of Service Protection
  family: System and Communications Protection
  description: |
    The information system protects against or limits the effects of the following types of denial of service attacks: _[Assignment: organization-defined types of denial of service attacks or references to sources for such information]_ by employing _[Assignment: organization-defined security safeguards]_.
SC-5 (1):
  name: Restrict Internal Users
  family: System and Communications Protection
  description: |
    The information system restricts the ability of individuals to launch _[Assignment: organization-defined denial of service attacks]_ against other information systems.
SC-5 (2):
  name: Excess Capacity / Bandwidth / Redundancy
  family: System and Communications Protection
  description: |
    The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding denial of service attacks.
SC-5 (3):
  name: Detection / Monitoring
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-5 (3)(a)** Employs _[Assignment: organization-defined monitoring tools]_ to detect indicators of denial of service attacks against the information system; and
      - **SC-5 (3)(b)** Monitors _[Assignment: organization-defined information system resources]_ to determine if sufficient resources exist to prevent effective denial of service attacks.
SC-6:
  name: Resource Availability
  family: System and Communications Protection
  description: |
    The information system protects the availability of resources by allocating _[Assignment: organization-defined resources]_ by [Selection (one or more); priority; quota; _[Assignment: organization-defined security safeguards]_].
SC-7:
  name: Boundary Protection
  family: System and Communications Protection
  description: |
    The information system:
      - **SC-7a.** Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system;
      - **SC-7b.** Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
      - **SC-7c.** Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-7 (1):
  name: Physically Separated Subnetworks
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-7]_.
SC-7 (2):
  name: Public Access
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-7]_.
SC-7 (3):
  name: Access Points
  family: System and Communications Protection
  description: |
    The organization limits the number of external network connections to the information system.
SC-7 (4):
  name: External Telecommunications Services
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-7 (4)(a)** Implements a managed interface for each external telecommunication service;
      - **SC-7 (4)(b)** Establishes a traffic flow policy for each managed interface;
      - **SC-7 (4)(c)** Protects the confidentiality and integrity of the information being transmitted across each interface;
      - **SC-7 (4)(d)** Documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and
      - **SC-7 (4)(e)** Reviews exceptions to the traffic flow policy _[Assignment: organization-defined frequency]_ and removes exceptions that are no longer supported by an explicit mission/business need.
SC-7 (5):
  name: Deny by Default / Allow by Exception
  family: System and Communications Protection
  description: |
    The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).
SC-7 (6):
  name: Response to Recognized Failures
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-7 (18)]_.
SC-7 (7):
  name: Prevent Split Tunneling for Remote Devices
  family: System and Communications Protection
  description: |
    The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.
SC-7 (8):
  name: Route Traffic to Authenticated Proxy Servers
  family: System and Communications Protection
  description: |
    The information system routes _[Assignment: organization-defined internal communications traffic]_ to _[Assignment: organization-defined external networks]_ through authenticated proxy servers at managed interfaces.
SC-7 (9):
  name: Restrict Threatening Outgoing Communications Traffic
  family: System and Communications Protection
  description: |
    The information system:
      - **SC-7 (9)(a)** Detects and denies outgoing communications traffic posing a threat to external information systems; and
      - **SC-7 (9)(b)** Audits the identity of internal users associated with denied communications.
SC-7 (10):
  name: Prevent Unauthorized Exfiltration
  family: System and Communications Protection
  description: |
    The organization prevents the unauthorized exfiltration of information across managed interfaces.
SC-7 (11):
  name: Restrict Incoming Communications Traffic
  family: System and Communications Protection
  description: |
    The information system only allows incoming communications from _[Assignment: organization-defined authorized sources]_ to be routed to _[Assignment: organization-defined authorized destinations]_.
SC-7 (12):
  name: Host-based Protection
  family: System and Communications Protection
  description: |
    The organization implements _[Assignment: organization-defined host-based boundary protection mechanisms]_ at _[Assignment: organization-defined information system components]_.
SC-7 (13):
  name: Isolation of Security Tools / Mechanisms / Support Components
  family: System and Communications Protection
  description: |
    The organization isolates _[Assignment: organization-defined information security tools, mechanisms, and support components]_ from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
SC-7 (14):
  name: Protects Against Unauthorized Physical Connections
  family: System and Communications Protection
  description: |
    The organization protects against unauthorized physical connections at _[Assignment: organization-defined managed interfaces]_.
SC-7 (15):
  name: Route Privileged Network Accesses
  family: System and Communications Protection
  description: |
    The information system routes all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
SC-7 (16):
  name: Prevent Discovery of Components / Devices
  family: System and Communications Protection
  description: |
    The information system prevents discovery of specific system components composing a managed interface.
SC-7 (17):
  name: Automated Enforcement of Protocol Formats
  family: System and Communications Protection
  description: |
    The information system enforces adherence to protocol formats.
SC-7 (18):
  name: Fail Secure
  family: System and Communications Protection
  description: |
    The information system fails securely in the event of an operational failure of a boundary protection device.
SC-7 (19):
  name: Blocks Communication From Non-organizationally Configured Hosts
  family: System and Communications Protection
  description: |
    The information system blocks both inbound and outbound communications traffic between _[Assignment: organization-defined communication clients]_ that are independently configured by end users and external service providers.
SC-7 (20):
  name: Dynamic Isolation / Segregation
  family: System and Communications Protection
  description: |
    The information system provides the capability to dynamically isolate/segregate _[Assignment: organization-defined information system components]_ from other components of the system.
SC-7 (21):
  name: Isolation of Information System Components
  family: System and Communications Protection
  description: |
    The organization employs boundary protection mechanisms to separate _[Assignment: organization-defined information system components]_ supporting _[Assignment: organization-defined missions and/or business functions]_.
SC-7 (22):
  name: Separate Subnets for Connecting to Different Security Domains
  family: System and Communications Protection
  description: |
    The information system implements separate network addresses (i.e., different subnets) to connect to systems in different security domains.
SC-7 (23):
  name: Disable Sender Feedback on Protocol Validation Failure
  family: System and Communications Protection
  description: |
    The information system disables feedback to senders on protocol format validation failure.
SC-8:
  name: Transmission Confidentiality and Integrity
  family: System and Communications Protection
  description: |
    The information system protects the [Selection (one or more): confidentiality; integrity] of transmitted information.
SC-8 (1):
  name: Cryptographic or Alternate Physical Protection
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission unless otherwise protected by _[Assignment: organization-defined alternative physical safeguards]_.
SC-8 (2):
  name: Pre / Post Transmission Handling
  family: System and Communications Protection
  description: |
    The information system maintains the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.
SC-8 (3):
  name: Cryptographic Protection for Message Externals
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to protect message externals unless otherwise protected by _[Assignment: organization-defined alternative physical safeguards]_.
SC-8 (4):
  name: Conceal / Randomize Communications
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by _[Assignment: organization-defined alternative physical safeguards]_.
SC-9:
  name: Transmission Confidentiality
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-8]_.
SC-10:
  name: Network Disconnect
  family: System and Communications Protection
  description: |
    The information system terminates the network connection associated with a communications session at the end of the session or after _[Assignment: organization-defined time period]_ of inactivity.
SC-11:
  name: Trusted Path
  family: System and Communications Protection
  description: |
    The information system establishes a trusted communications path between the user and the following security functions of the system: _[Assignment: organization-defined security functions to include at a minimum, information system authentication and re-authentication]_.
SC-11 (1):
  name: Logical Isolation
  family: System and Communications Protection
  description: |
    The information system provides a trusted communications path that is logically isolated and distinguishable from other paths.
SC-12:
  name: Cryptographic Key Establishment and Management
  family: System and Communications Protection
  description: |
    The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with _[Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]_.
SC-12 (1):
  name: Availability
  family: System and Communications Protection
  description: |
    The organization maintains availability of information in the event of the loss of cryptographic keys by users.
SC-12 (2):
  name: Symmetric Keys
  family: System and Communications Protection
  description: |
    The organization produces, controls, and distributes symmetric cryptographic keys using [Selection: NIST FIPS-compliant; NSA-approved] key management technology and processes.
SC-12 (3):
  name: Asymmetric Keys
  family: System and Communications Protection
  description: |
    The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key].
SC-12 (4):
  name: Pki Certificates
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-12]_.
SC-12 (5):
  name: Pki Certificates / Hardware Tokens
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-12]_.
SC-13:
  name: Cryptographic Protection
  family: System and Communications Protection
  description: |
    The information system implements _[Assignment: organization-defined cryptographic uses and type of cryptography required for each use]_ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
SC-13 (1):
  name: Fips-validated Cryptography
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-13]_.
SC-13 (2):
  name: Nsa-approved Cryptography
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-13]_.
SC-13 (3):
  name: Individuals Without Formal Access  Approvals
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-13]_.
SC-13 (4):
  name: Digital Signatures
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-13]_.
SC-14:
  name: Public Access Protections
  family: System and Communications Protection
  description: |
    _[Withdrawn: Capability provided by AC-2, AC-3, AC-5, AC-6, SI-3, SI-4, SI-5, SI-7, SI-10]_.
SC-15:
  name: Collaborative Computing Devices
  family: System and Communications Protection
  description: |
    The information system:
      - **SC-15a.** Prohibits remote activation of collaborative computing devices with the following exceptions: _[Assignment: organization-defined exceptions where remote activation is to be allowed]_; and
      - **SC-15b.** Provides an explicit indication of use to users physically present at the devices.
SC-15 (1):
  name: Physical Disconnect
  family: System and Communications Protection
  description: |
    The information system provides physical disconnect of collaborative computing devices in a manner that supports ease of use.
SC-15 (2):
  name: Blocking Inbound / Outbound Communications Traffic
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-7]_.
SC-15 (3):
  name: Disabling / Removal in Secure Work Areas
  family: System and Communications Protection
  description: |
    The organization disables or removes collaborative computing devices from _[Assignment: organization-defined information systems or information system components]_ in _[Assignment: organization-defined secure work areas]_.
SC-15 (4):
  name: Explicitly Indicate Current Participants
  family: System and Communications Protection
  description: |
    The information system provides an explicit indication of current participants in _[Assignment: organization-defined online meetings and teleconferences]_.
SC-16:
  name: Transmission of Security Attributes
  family: System and Communications Protection
  description: |
    The information system associates _[Assignment: organization-defined security attributes]_ with information exchanged between information systems and between system components.
SC-16 (1):
  name: Integrity Validation
  family: System and Communications Protection
  description: |
    The information system validates the integrity of transmitted security attributes.
SC-17:
  name: Public Key Infrastructure Certificates
  family: System and Communications Protection
  description: |
    The organization issues public key certificates under an _[Assignment: organization-defined certificate policy]_ or obtains public key certificates from an approved service provider.
SC-18:
  name: Mobile Code
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-18a.** Defines acceptable and unacceptable mobile code and mobile code technologies;
      - **SC-18b.** Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and
      - **SC-18c.** Authorizes, monitors, and controls the use of mobile code within the information system.
SC-18 (1):
  name: Identify Unacceptable Code / Take Corrective Actions
  family: System and Communications Protection
  description: |
    The information system identifies _[Assignment: organization-defined unacceptable mobile code]_ and takes _[Assignment: organization-defined corrective actions]_.
SC-18 (2):
  name: Acquisition / Development / Use
  family: System and Communications Protection
  description: |
    The organization ensures that the acquisition, development, and use of mobile code to be deployed in the information system meets _[Assignment: organization-defined mobile code requirements]_.
SC-18 (3):
  name: Prevent Downloading / Execution
  family: System and Communications Protection
  description: |
    The information system prevents the download and execution of _[Assignment: organization-defined unacceptable mobile code]_.
SC-18 (4):
  name: Prevent Automatic Execution
  family: System and Communications Protection
  description: |
    The information system prevents the automatic execution of mobile code in _[Assignment: organization-defined software applications]_ and enforces _[Assignment: organization-defined actions]_ prior to executing the code.
SC-18 (5):
  name: Allow Execution Only in Confined Environments
  family: System and Communications Protection
  description: |
    The organization allows execution of permitted mobile code only in confined virtual machine environments.
SC-19:
  name: Voice Over Internet Protocol
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-19a.** Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and
      - **SC-19b.** Authorizes, monitors, and controls the use of VoIP within the information system.
SC-20:
  name: Secure Name / Address Resolution Service (authoritative Source)
  family: System and Communications Protection
  description: |
    The information system:
      - **SC-20a.** Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and
      - **SC-20b.** Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
SC-20 (1):
  name: Child Subspaces
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-20]_.
SC-20 (2):
  name: Data Origin / Integrity
  family: System and Communications Protection
  description: |
    The information system provides data origin and integrity protection artifacts for internal name/address resolution queries.
SC-21:
  name: Secure Name / Address Resolution Service (recursive or Caching Resolver)
  family: System and Communications Protection
  description: |
    The information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
SC-21 (1):
  name: Data Origin / Integrity
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-21]_.
SC-22:
  name: Architecture and Provisioning for Name / Address Resolution Service
  family: System and Communications Protection
  description: |
    The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.
SC-23:
  name: Session Authenticity
  family: System and Communications Protection
  description: |
    The information system protects the authenticity of communications sessions.
SC-23 (1):
  name: Invalidate Session Identifiers at Logout
  family: System and Communications Protection
  description: |
    The information system invalidates session identifiers upon user logout or other session termination.
SC-23 (2):
  name: User-initiated Logouts / Message Displays
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into AC-12 (1)]_.
SC-23 (3):
  name: Unique Session Identifiers With Randomization
  family: System and Communications Protection
  description: |
    The information system generates a unique session identifier for each session with _[Assignment: organization-defined randomness requirements]_ and recognizes only session identifiers that are system-generated.
SC-23 (4):
  name: Unique Session Identifiers With Randomization
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-23 (3)]_.
SC-23 (5):
  name: Allowed Certificate Authorities
  family: System and Communications Protection
  description: |
    The information system only allows the use of _[Assignment: organization-defined certificate authorities]_ for verification of the establishment of protected sessions.
SC-24:
  name: Fail in Known State
  family: System and Communications Protection
  description: |
    The information system fails to a _[Assignment: organization-defined known-state]_ for _[Assignment: organization-defined types of failures]_ preserving _[Assignment: organization-defined system state information]_ in failure.
SC-25:
  name: Thin Nodes
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined information system components]_ with minimal functionality and information storage.
SC-26:
  name: Honeypots
  family: System and Communications Protection
  description: |
    The information system includes components specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting, and analyzing such attacks.
SC-26 (1):
  name: Detection of Malicious Code
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-35]_.
SC-27:
  name: Platform-independent Applications
  family: System and Communications Protection
  description: |
    The information system includes: _[Assignment: organization-defined platform-independent applications]_.
SC-28:
  name: Protection of Information at Rest
  family: System and Communications Protection
  description: |
    The information system protects the [Selection (one or more): confidentiality; integrity] of _[Assignment: organization-defined information at rest]_.
SC-28 (1):
  name: Cryptographic Protection
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of _[Assignment: organization-defined information]_ on _[Assignment: organization-defined information system components]_.
SC-28 (2):
  name: Off-line Storage
  family: System and Communications Protection
  description: |
    The organization removes from online storage and stores off-line in a secure location _[Assignment: organization-defined information]_.
SC-29:
  name: Heterogeneity
  family: System and Communications Protection
  description: |
    The organization employs a diverse set of information technologies for _[Assignment: organization-defined information system components]_ in the implementation of the information system.
SC-29 (1):
  name: Virtualization Techniques
  family: System and Communications Protection
  description: |
    The organization employs virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed _[Assignment: organization-defined frequency]_.
SC-30:
  name: Concealment and Misdirection
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined concealment and misdirection techniques]_ for _[Assignment: organization-defined information systems]_ at _[Assignment: organization-defined time periods]_ to confuse and mislead adversaries.
SC-30 (1):
  name: Virtualization Techniques
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-29 (1)]_.
SC-30 (2):
  name: Randomness
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined techniques]_ to introduce randomness into organizational operations and assets.
SC-30 (3):
  name: Change Processing / Storage Locations
  family: System and Communications Protection
  description: |
    The organization changes the location of _[Assignment: organization-defined processing and/or storage]_ [Selection: _[Assignment: organization-defined time frequency]_; at random time intervals]].
SC-30 (4):
  name: Misleading Information
  family: System and Communications Protection
  description: |
    The organization employs realistic, but misleading information in _[Assignment: organization-defined information system components]_ with regard to its security state or posture.
SC-30 (5):
  name: Concealment of System Components
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined techniques]_ to hide or conceal _[Assignment: organization-defined information system components]_.
SC-31:
  name: Covert Channel Analysis
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-31a.** Performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert [Selection (one or more): storage; timing] channels; and
      - **SC-31b.** Estimates the maximum bandwidth of those channels.
SC-31 (1):
  name: Test Covert Channels for Exploitability
  family: System and Communications Protection
  description: |
    The organization tests a subset of the identified covert channels to determine which channels are exploitable.
SC-31 (2):
  name: Maximum Bandwidth
  family: System and Communications Protection
  description: |
    The organization reduces the maximum bandwidth for identified covert [Selection (one or more); storage; timing] channels to _[Assignment: organization-defined values]_.
SC-31 (3):
  name: Measure Bandwidth in Operational Environments
  family: System and Communications Protection
  description: |
    The organization measures the bandwidth of _[Assignment: organization-defined subset of identified covert channels]_ in the operational environment of the information system.
SC-32:
  name: Information System Partitioning
  family: System and Communications Protection
  description: |
    The organization partitions the information system into _[Assignment: organization-defined information system components]_ residing in separate physical domains or environments based on _[Assignment: organization-defined circumstances for physical separation of components]_.
SC-33:
  name: Transmission Preparation Integrity
  family: System and Communications Protection
  description: |
    _[Withdrawn: Incorporated into SC-8]_.
SC-34:
  name: Non-modifiable Executable Programs
  family: System and Communications Protection
  description: |
    The information system at _[Assignment: organization-defined information system components]_:
      - **SC-34a.** Loads and executes the operating environment from hardware-enforced, read-only media; and
      - **SC-34b.** Loads and executes _[Assignment: organization-defined applications]_ from hardware-enforced, read-only media.
SC-34 (1):
  name: No Writable Storage
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined information system components]_ with no writeable storage that is persistent across component restart or power on/off.
SC-34 (2):
  name: Integrity Protection / Read-only Media
  family: System and Communications Protection
  description: |
    The organization protects the integrity of information prior to storage on read-only media and controls the media after such information has been recorded onto the media.
SC-34 (3):
  name: Hardware-based Protection
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-34 (3)(a)** Employs hardware-based, write-protect for _[Assignment: organization-defined information system firmware components]_; and
      - **SC-34 (3)(b)** Implements specific procedures for _[Assignment: organization-defined authorized individuals]_ to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.
SC-35:
  name: Honeyclients
  family: System and Communications Protection
  description: |
    The information system includes components that proactively seek to identify malicious websites and/or web-based malicious code.
SC-36:
  name: Distributed Processing and Storage
  family: System and Communications Protection
  description: |
    The organization distributes _[Assignment: organization-defined processing and storage]_ across multiple physical locations.
SC-36 (1):
  name: Polling Techniques
  family: System and Communications Protection
  description: |
    The organization employs polling techniques to identify potential faults, errors, or compromises to _[Assignment: organization-defined distributed processing and storage components]_.
SC-37:
  name: Out-of-band Channels
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined out-of-band channels]_ for the physical delivery or electronic transmission of _[Assignment: organization-defined information, information system components, or devices]_ to _[Assignment: organization-defined individuals or information systems]_.
SC-37 (1):
  name: Ensure Delivery / Transmission
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined security safeguards]_ to ensure that only _[Assignment: organization-defined individuals or information systems]_ receive the _[Assignment: organization-defined information, information system components, or devices]_.
SC-38:
  name: Operations Security
  family: System and Communications Protection
  description: |
    The organization employs _[Assignment: organization-defined operations security safeguards]_ to protect key organizational information throughout the system development life cycle.
SC-39:
  name: Process Isolation
  family: System and Communications Protection
  description: |
    The information system maintains a separate execution domain for each executing process.
SC-39 (1):
  name: Hardware Separation
  family: System and Communications Protection
  description: |
    The information system implements underlying hardware separation mechanisms to facilitate process separation.
SC-39 (2):
  name: Thread Isolation
  family: System and Communications Protection
  description: |
    The information system maintains a separate execution domain for each thread in _[Assignment: organization-defined multi-threaded processing]_.
SC-40:
  name: Wireless Link Protection
  family: System and Communications Protection
  description: |
    The information system protects external and internal _[Assignment: organization-defined wireless links]_ from _[Assignment: organization-defined types of signal parameter attacks or references to sources for such attacks]_.
SC-40 (1):
  name: Electromagnetic Interference
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms that achieve _[Assignment: organization-defined level of protection]_ against the effects of intentional electromagnetic interference.
SC-40 (2):
  name: Reduce Detection Potential
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to reduce the detection potential of wireless links to _[Assignment: organization-defined level of reduction]_.
SC-40 (3):
  name: Imitative or Manipulative Communications Deception
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
SC-40 (4):
  name: Signal Parameter Identification
  family: System and Communications Protection
  description: |
    The information system implements cryptographic mechanisms to prevent the identification of _[Assignment: organization-defined wireless transmitters]_ by using the transmitter signal parameters.
SC-41:
  name: Port and I/o Device Access
  family: System and Communications Protection
  description: |
    The organization physically disables or removes _[Assignment: organization-defined connection ports or input/output devices]_ on _[Assignment: organization-defined information systems or information system components]_.
SC-42:
  name: Sensor Capability and Data
  family: System and Communications Protection
  description: |
    The information system:
      - **SC-42a.** Prohibits the remote activation of environmental sensing capabilities with the following exceptions: _[Assignment: organization-defined exceptions where remote activation of sensors is allowed]_; and
      - **SC-42b.** Provides an explicit indication of sensor use to _[Assignment: organization-defined class of users]_.
SC-42 (1):
  name: Reporting to Authorized Individuals or Roles
  family: System and Communications Protection
  description: |
    The organization ensures that the information system is configured so that data or information collected by the _[Assignment: organization-defined sensors]_ is only reported to authorized individuals or roles.
SC-42 (2):
  name: Authorized Use
  family: System and Communications Protection
  description: |
    The organization employs the following measures: _[Assignment: organization-defined measures]_, so that data or information collected by _[Assignment: organization-defined sensors]_ is only used for authorized purposes.
SC-42 (3):
  name: Prohibit Use of Devices
  family: System and Communications Protection
  description: |
    The organization prohibits the use of devices possessing _[Assignment: organization-defined environmental sensing capabilities]_ in _[Assignment: organization-defined facilities, areas, or systems]_.
SC-43:
  name: Usage Restrictions
  family: System and Communications Protection
  description: |
    The organization:
      - **SC-43a.** Establishes usage restrictions and implementation guidance for _[Assignment: organization-defined information system components]_ based on the potential to cause damage to the information system if used maliciously; and
      - **SC-43b.** Authorizes, monitors, and controls the use of such components within the information system.
SC-44:
  name: Detonation Chambers
  family: System and Communications Protection
  description: |
    The organization employs a detonation chamber capability within _[Assignment: organization-defined information system, system component, or location]_.
SI-1:
  name: System and Information Integrity Policy and Procedures
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-1a.** Develops, documents, and disseminates to _[Assignment: organization-defined personnel or roles]_:
        - **SI-1a.1.** A system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
        - **SI-1a.2.** Procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls; and
      - **SI-1b.** Reviews and updates the current:
        - **SI-1b.1.** System and information integrity policy _[Assignment: organization-defined frequency]_; and
        - **SI-1b.2.** System and information integrity procedures _[Assignment: organization-defined frequency]_.
SI-2:
  name: Flaw Remediation
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-2a.** Identifies, reports, and corrects information system flaws;
      - **SI-2b.** Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
      - **SI-2c.** Installs security-relevant software and firmware updates within _[Assignment: organization-defined time period]_ of the release of the updates; and
      - **SI-2d.** Incorporates flaw remediation into the organizational configuration management process.
SI-2 (1):
  name: Central Management
  family: System and Information Integrity
  description: |
    The organization centrally manages the flaw remediation process.
SI-2 (2):
  name: Automated Flaw Remediation Status
  family: System and Information Integrity
  description: |
    The organization employs automated mechanisms _[Assignment: organization-defined frequency]_ to determine the state of information system components with regard to flaw remediation.
SI-2 (3):
  name: Time to Remediate Flaws / Benchmarks for Corrective Actions
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-2 (3)(a)** Measures the time between flaw identification and flaw remediation; and
      - **SI-2 (3)(b)** Establishes _[Assignment: organization-defined benchmarks]_ for taking corrective actions.
SI-2 (4):
  name: Automated Patch Management Tools
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into SI-2]_.
SI-2 (5):
  name: Automatic Software / Firmware Updates
  family: System and Information Integrity
  description: |
    The organization installs _[Assignment: organization-defined security-relevant software and firmware updates]_ automatically to _[Assignment: organization-defined information system components]_.
SI-2 (6):
  name: Removal of Previous Versions of Software / Firmware
  family: System and Information Integrity
  description: |
    The organization removes _[Assignment: organization-defined software and firmware components]_ after updated versions have been installed.
SI-3:
  name: Malicious Code Protection
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-3a.** Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;
      - **SI-3b.** Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;
      - **SI-3c.** Configures malicious code protection mechanisms to:
        - **SI-3c.1.** Perform periodic scans of the information system _[Assignment: organization-defined frequency]_ and real-time scans of files from external sources at [Selection (one or more); endpoint; network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and
        - **SI-3c.2.** [Selection (one or more): block malicious code; quarantine malicious code;  send alert to administrator; _[Assignment: organization-defined action]_] in response to malicious code detection; and
      - **SI-3d.** Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.
SI-3 (1):
  name: Central Management
  family: System and Information Integrity
  description: |
    The organization centrally manages malicious code protection mechanisms.
SI-3 (2):
  name: Automatic Updates
  family: System and Information Integrity
  description: |
    The information system automatically updates malicious code protection mechanisms.
SI-3 (3):
  name: Non-privileged Users
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into AC-6 (10)]_.
SI-3 (4):
  name: Updates Only by Privileged Users
  family: System and Information Integrity
  description: |
    The information system updates malicious code protection mechanisms only when directed by a privileged user.
SI-3 (5):
  name: Portable Storage Devices
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into MP-7]_.
SI-3 (6):
  name: Testing / Verification
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-3 (6)(a)** Tests malicious code protection mechanisms _[Assignment: organization-defined frequency]_ by introducing a known benign, non-spreading test case into the information system; and
      - **SI-3 (6)(b)** Verifies that both detection of the test case and associated incident reporting occur.
SI-3 (7):
  name: Nonsignature-based Detection
  family: System and Information Integrity
  description: |
    The information system implements nonsignature-based malicious code detection mechanisms.
SI-3 (8):
  name: Detect Unauthorized Commands
  family: System and Information Integrity
  description: |
    The information system detects _[Assignment: organization-defined unauthorized operating system commands]_ through the kernel application programming interface at _[Assignment: organization-defined information system hardware components]_ and [Selection (one or more): issues a warning; audits the command execution; prevents the execution of the command].
SI-3 (9):
  name: Authenticate Remote Commands
  family: System and Information Integrity
  description: |
    The information system implements _[Assignment: organization-defined security safeguards]_ to authenticate _[Assignment: organization-defined remote commands]_.
SI-3 (10):
  name: Malicious Code Analysis
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-3 (10)(a)** Employs _[Assignment: organization-defined tools and techniques]_ to analyze the characteristics and behavior of malicious code; and
      - **SI-3 (10)(b)** Incorporates the results from malicious code analysis into organizational incident response and flaw remediation processes.
SI-4:
  name: Information System Monitoring
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-4a.** Monitors the information system to detect:
        - **SI-4a.1.** Attacks and indicators of potential attacks in accordance with _[Assignment: organization-defined monitoring objectives]_; and
        - **SI-4a.2.** Unauthorized local, network, and remote connections;
      - **SI-4b.** Identifies unauthorized use of the information system through _[Assignment: organization-defined techniques and methods]_;
      - **SI-4c.** Deploys monitoring devices:
        - **SI-4c.1.** Strategically within the information system to collect organization-determined essential information; and
        - **SI-4c.2.** At ad hoc locations within the system to track specific types of transactions of interest to the organization;
      - **SI-4d.** Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;
      - **SI-4e.** Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;
      - **SI-4f.** Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and
      - **SI-4g.** Provides _[Assignment: organization-defined information system monitoring information]_ to _[Assignment: organization-defined personnel or roles]_ [Selection (one or more): as needed; _[Assignment: organization-defined frequency]_].
SI-4 (1):
  name: System-wide Intrusion Detection System
  family: System and Information Integrity
  description: |
    The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.
SI-4 (2):
  name: Automated Tools for Real-time Analysis
  family: System and Information Integrity
  description: |
    The organization employs automated tools to support near real-time analysis of events.
SI-4 (3):
  name: Automated Tool Integration
  family: System and Information Integrity
  description: |
    The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.
SI-4 (4):
  name: Inbound and Outbound Communications Traffic
  family: System and Information Integrity
  description: |
    The information system monitors inbound and outbound communications traffic _[Assignment: organization-defined frequency]_ for unusual or unauthorized activities or conditions.
SI-4 (5):
  name: System-generated Alerts
  family: System and Information Integrity
  description: |
    The information system alerts _[Assignment: organization-defined personnel or roles]_ when the following indications of compromise or potential compromise occur: _[Assignment: organization-defined compromise indicators]_.
SI-4 (6):
  name: Restrict Non-privileged Users
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into AC-6 (10)]_.
SI-4 (7):
  name: Automated Response to Suspicious Events
  family: System and Information Integrity
  description: |
    The information system notifies _[Assignment: organization-defined incident response personnel (identified by name and/or by role)]_ of detected suspicious events and takes _[Assignment: organization-defined least-disruptive actions to terminate suspicious events]_.
SI-4 (8):
  name: Protection of Monitoring Information
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into SI-4]_.
SI-4 (9):
  name: Testing of Monitoring Tools
  family: System and Information Integrity
  description: |
    The organization tests intrusion-monitoring tools _[Assignment: organization-defined frequency]_.
SI-4 (10):
  name: Visibility of Encrypted Communications
  family: System and Information Integrity
  description: |
    The organization makes provisions so that _[Assignment: organization-defined encrypted communications traffic]_ is visible to _[Assignment: organization-defined information system monitoring tools]_.
SI-4 (11):
  name: Analyze Communications Traffic Anomalies
  family: System and Information Integrity
  description: |
    The organization analyzes outbound communications traffic at the external boundary of the information system and selected _[Assignment: organization-defined interior points within the system (e.g., subnetworks, subsystems)]_ to discover anomalies.
SI-4 (12):
  name: Automated Alerts
  family: System and Information Integrity
  description: |
    The organization employs automated mechanisms to alert security personnel of the following inappropriate or unusual activities with security implications: _[Assignment: organization-defined activities that trigger alerts]_.
SI-4 (13):
  name: Analyze Traffic / Event Patterns
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-4 (13)(a)** Analyzes communications traffic/event patterns for the information system;
      - **SI-4 (13)(b)** Develops profiles representing common traffic patterns and/or events; and
      - **SI-4 (13)(c)** Uses the traffic/event profiles in tuning system-monitoring devices to reduce the number of false positives and the number of false negatives.
SI-4 (14):
  name: Wireless Intrusion Detection
  family: System and Information Integrity
  description: |
    The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.
SI-4 (15):
  name: Wireless to Wireline Communications
  family: System and Information Integrity
  description: |
    The organization employs an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
SI-4 (16):
  name: Correlate Monitoring Information
  family: System and Information Integrity
  description: |
    The organization correlates information from monitoring tools employed throughout the information system.
SI-4 (17):
  name: Integrated Situational Awareness
  family: System and Information Integrity
  description: |
    The organization correlates information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
SI-4 (18):
  name: Analyze Traffic / Covert Exfiltration
  family: System and Information Integrity
  description: |
    The organization analyzes outbound communications traffic at the external boundary of the information system (i.e., system perimeter) and at _[Assignment: organization-defined interior points within the system (e.g., subsystems, subnetworks)]_ to detect covert exfiltration of information.
SI-4 (19):
  name: Individuals Posing Greater Risk
  family: System and Information Integrity
  description: |
    The organization implements _[Assignment: organization-defined additional monitoring]_ of individuals who have been identified by _[Assignment: organization-defined sources]_ as posing an increased level of risk.
SI-4 (20):
  name: Privileged Users
  family: System and Information Integrity
  description: |
    The organization implements _[Assignment: organization-defined additional monitoring]_ of privileged users.
SI-4 (21):
  name: Probationary Periods
  family: System and Information Integrity
  description: |
    The organization implements _[Assignment: organization-defined additional monitoring]_ of individuals during _[Assignment: organization-defined probationary period]_.
SI-4 (22):
  name: Unauthorized Network Services
  family: System and Information Integrity
  description: |
    The information system detects network services that have not been authorized or approved by _[Assignment: organization-defined authorization or approval processes]_ and [Selection (one or more): audits; alerts _[Assignment: organization-defined personnel or roles]_].
SI-4 (23):
  name: Host-based Devices
  family: System and Information Integrity
  description: |
    The organization implements _[Assignment: organization-defined host-based monitoring mechanisms]_ at _[Assignment: organization-defined information system components]_.
SI-4 (24):
  name: Indicators of Compromise
  family: System and Information Integrity
  description: |
    The information system discovers, collects, distributes, and uses indicators of compromise.
SI-5:
  name: Security Alerts, Advisories, and Directives
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-5a.** Receives information system security alerts, advisories, and directives from _[Assignment: organization-defined external organizations]_ on an ongoing basis;
      - **SI-5b.** Generates internal security alerts, advisories, and directives as deemed necessary;
      - **SI-5c.** Disseminates security alerts, advisories, and directives to: [Selection (one or more): _[Assignment: organization-defined personnel or roles]_; _[Assignment: organization-defined elements within the organization]_; _[Assignment: organization-defined external organizations]_]; and
      - **SI-5d.** Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.
SI-5 (1):
  name: Automated Alerts and Advisories
  family: System and Information Integrity
  description: |
    The organization employs automated mechanisms to make security alert and advisory information available throughout the organization.
SI-6:
  name: Security Function Verification
  family: System and Information Integrity
  description: |
    The information system:
      - **SI-6a.** Verifies the correct operation of _[Assignment: organization-defined security functions]_;
      - **SI-6b.** Performs this verification [Selection (one or more): _[Assignment: organization-defined system transitional states]_; upon command by user with appropriate privilege; _[Assignment: organization-defined frequency]_];
      - **SI-6c.** Notifies _[Assignment: organization-defined personnel or roles]_ of failed security verification tests; and
      - **SI-6d.** [Selection (one or more): shuts the information system down; restarts the information system; _[Assignment: organization-defined alternative action(s)]_] when anomalies are discovered.
SI-6 (1):
  name: Notification of Failed Security Tests
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into SI-6]_.
SI-6 (2):
  name: Automation Support for Distributed Testing
  family: System and Information Integrity
  description: |
    The information system implements automated mechanisms to support the management of distributed security testing.
SI-6 (3):
  name: Report Verification Results
  family: System and Information Integrity
  description: |
    The organization reports the results of security function verification to _[Assignment: organization-defined personnel or roles]_.
SI-7:
  name: Software, Firmware, and Information Integrity
  family: System and Information Integrity
  description: |
    The organization employs integrity verification tools to detect unauthorized changes to _[Assignment: organization-defined software, firmware, and information]_.
SI-7 (1):
  name: Integrity Checks
  family: System and Information Integrity
  description: |
    The information system performs an integrity check of _[Assignment: organization-defined software, firmware, and information]_ [Selection (one or more): at startup; at _[Assignment: organization-defined transitional states or security-relevant events]_; _[Assignment: organization-defined frequency]_].
SI-7 (2):
  name: Automated Notifications of Integrity Violations
  family: System and Information Integrity
  description: |
    The organization employs automated tools that provide notification to _[Assignment: organization-defined personnel or roles]_ upon discovering discrepancies during integrity verification.
SI-7 (3):
  name: Centrally-managed Integrity Tools
  family: System and Information Integrity
  description: |
    The organization employs centrally managed integrity verification tools.
SI-7 (4):
  name: Tamper-evident Packaging
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into SA-12]_.
SI-7 (5):
  name: Automated Response to Integrity Violations
  family: System and Information Integrity
  description: |
    The information system automatically [Selection (one or more): shuts the information system down; restarts the information system; implements _[Assignment: organization-defined security safeguards]_] when integrity violations are discovered.
SI-7 (6):
  name: Cryptographic Protection
  family: System and Information Integrity
  description: |
    The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
SI-7 (7):
  name: Integration of Detection and Response
  family: System and Information Integrity
  description: |
    The organization incorporates the detection of unauthorized _[Assignment: organization-defined security-relevant changes to the information system]_ into the organizational incident response capability.
SI-7 (8):
  name: Auditing Capability for Significant Events
  family: System and Information Integrity
  description: |
    The information system, upon detection of a potential integrity violation, provides the capability to audit the event and initiates the following actions: [Selection (one or more): generates an audit record; alerts current user; alerts _[Assignment: organization-defined personnel or roles]_; _[Assignment: organization-defined other actions]_].
SI-7 (9):
  name: Verify Boot Process
  family: System and Information Integrity
  description: |
    The information system verifies the integrity of the boot process of _[Assignment: organization-defined devices]_.
SI-7 (10):
  name: Protection of Boot Firmware
  family: System and Information Integrity
  description: |
    The information system implements _[Assignment: organization-defined security safeguards]_ to protect the integrity of boot firmware in _[Assignment: organization-defined devices]_.
SI-7 (11):
  name: Confined Environments With Limited Privileges
  family: System and Information Integrity
  description: |
    The organization requires that _[Assignment: organization-defined user-installed software]_ execute in a confined physical or virtual machine environment with limited privileges.
SI-7 (12):
  name: Integrity Verification
  family: System and Information Integrity
  description: |
    The organization requires that the integrity of _[Assignment: organization-defined user-installed software]_ be verified prior to execution.
SI-7 (13):
  name: Code Execution in Protected Environments
  family: System and Information Integrity
  description: |
    The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments and with the explicit approval of _[Assignment: organization-defined personnel or roles]_.
SI-7 (14):
  name: Binary or Machine Executable Code
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-7 (14)(a)** Prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code; and
      - **SI-7 (14)(b)** Provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.
SI-7 (15):
  name: Code Authentication
  family: System and Information Integrity
  description: |
    The information system implements cryptographic mechanisms to authenticate _[Assignment: organization-defined software or firmware components]_ prior to installation.
SI-7 (16):
  name: Time Limit on Process Execution W/o Supervision
  family: System and Information Integrity
  description: |
    The organization does not allow processes to execute without supervision for more than _[Assignment: organization-defined time period]_.
SI-8:
  name: Spam Protection
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-8a.** Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and
      - **SI-8b.** Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
SI-8 (1):
  name: Central Management
  family: System and Information Integrity
  description: |
    The organization centrally manages spam protection mechanisms.
SI-8 (2):
  name: Automatic Updates
  family: System and Information Integrity
  description: |
    The information system automatically updates spam protection mechanisms.
SI-8 (3):
  name: Continuous Learning Capability
  family: System and Information Integrity
  description: |
    The information system implements spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
SI-9:
  name: Information Input Restrictions
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into AC-2, AC-3, AC-5, AC-6]_.
SI-10:
  name: Information Input Validation
  family: System and Information Integrity
  description: |
    The information system checks the validity of _[Assignment: organization-defined information inputs]_.
SI-10 (1):
  name: Manual Override Capability
  family: System and Information Integrity
  description: |
    The information system:
      - **SI-10 (1)(a)** Provides a manual override capability for input validation of _[Assignment: organization-defined inputs]_;
      - **SI-10 (1)(b)** Restricts the use of the manual override capability to only _[Assignment: organization-defined authorized individuals]_; and
      - **SI-10 (1)(c)** Audits the use of the manual override capability.
SI-10 (2):
  name: Review / Resolution of Errors
  family: System and Information Integrity
  description: |
    The organization ensures that input validation errors are reviewed and resolved within _[Assignment: organization-defined time period]_.
SI-10 (3):
  name: Predictable Behavior
  family: System and Information Integrity
  description: |
    The information system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
SI-10 (4):
  name: Review / Timing Interactions
  family: System and Information Integrity
  description: |
    The organization accounts for timing interactions among information system components in determining appropriate responses for invalid inputs.
SI-10 (5):
  name: Restrict Inputs to Trusted Sources and Approved Formats
  family: System and Information Integrity
  description: |
    The organization restricts the use of information inputs to _[Assignment: organization-defined trusted sources]_ and/or _[Assignment: organization-defined formats]_.
SI-11:
  name: Error Handling
  family: System and Information Integrity
  description: |
    The information system:
      - **SI-11a.** Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and
      - **SI-11b.** Reveals error messages only to _[Assignment: organization-defined personnel or roles]_.
SI-12:
  name: Information Handling and Retention
  family: System and Information Integrity
  description: |
    The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
SI-13:
  name: Predictable Failure Prevention
  family: System and Information Integrity
  description: |
    The organization:
      - **SI-13a.** Determines mean time to failure (MTTF) for _[Assignment: organization-defined information system components]_ in specific environments of operation; and
      - **SI-13b.** Provides substitute information system components and a means to exchange active and standby components at _[Assignment: organization-defined MTTF substitution criteria]_.
SI-13 (1):
  name: Transferring Component Responsibilities
  family: System and Information Integrity
  description: |
    The organization takes information system components out of service by transferring component responsibilities to substitute components no later than _[Assignment: organization-defined fraction or percentage]_ of mean time to failure.
SI-13 (2):
  name: Time Limit on Process Execution Without Supervision
  family: System and Information Integrity
  description: |
    _[Withdrawn: Incorporated into SI-7 (16)]_.
SI-13 (3):
  name: Manual Transfer Between Components
  family: System and Information Integrity
  description: |
    The organization manually initiates transfers between active and standby information system components _[Assignment: organization-defined frequency]_ if the mean time to failure exceeds _[Assignment: organization-defined time period]_.
SI-13 (4):
  name: Standby Component Installation / Notification
  family: System and Information Integrity
  description: |
    The organization, if information system component failures are detected:
      - **SI-13 (4)(a)** Ensures that the standby components are successfully and transparently installed within _[Assignment: organization-defined time period]_; and
      - **SI-13 (4)(b)** [Selection (one or more): activates _[Assignment: organization-defined alarm]_; automatically shuts down the information system].
SI-13 (5):
  name: Failover Capability
  family: System and Information Integrity
  description: |
    The organization provides [Selection: real-time; near real-time] _[Assignment: organization-defined failover capability]_ for the information system.
SI-14:
  name: Non-persistence
  family: System and Information Integrity
  description: |
    The organization implements non-persistent _[Assignment: organization-defined information system components and services]_ that are initiated in a known state and terminated [Selection (one or more): upon end of session of use; periodically at _[Assignment: organization-defined frequency]_].
SI-14 (1):
  name: Refresh From Trusted Sources
  family: System and Information Integrity
  description: |
    The organization ensures that software and data employed during information system component and service refreshes are obtained from _[Assignment: organization-defined trusted sources]_.
SI-15:
  name: Information Output Filtering
  family: System and Information Integrity
  description: |
    The information system validates information output from _[Assignment: organization-defined software programs and/or applications]_ to ensure that the information is consistent with the expected content.
SI-16:
  name: Memory Protection
  family: System and Information Integrity
  description: |
    The information system implements _[Assignment: organization-defined security safeguards]_ to protect its memory from unauthorized code execution.
SI-17:
  name: Fail-safe Procedures
  family: System and Information Integrity
  description: |
    The information system implements _[Assignment: organization-defined fail-safe procedures]_ when _[Assignment: organization-defined failure conditions occur]_.
PM-1:
  name: Information Security Program Plan
  family: Program Management
  description: |
    The organization:
      - **PM-1a.** Develops and disseminates an organization-wide information security program plan that:
        - **PM-1a.1.** Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
        - **PM-1a.2.** Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
        - **PM-1a.3.** Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
        - **PM-1a.4.** Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
      - **PM-1b.** Reviews the organization-wide information security program plan _[Assignment: organization-defined frequency]_;
      - **PM-1c.** Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
      - **PM-1d.** Protects the information security program plan from unauthorized disclosure and modification.
PM-2:
  name: Senior Information Security Officer
  family: Program Management
  description: |
    The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
PM-3:
  name: Information Security Resources
  family: Program Management
  description: |
    The organization:
      - **PM-3a.** Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement;
      - **PM-3b.** Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and
      - **PM-3c.** Ensures that information security resources are available for expenditure as planned.
PM-4:
  name: Plan of Action and Milestones Process
  family: Program Management
  description: |
    The organization:
      - **PM-4a.** Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:
        - **PM-4a.1.** Are developed and maintained;
        - **PM-4a.2.** Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
        - **PM-4a.3.** Are reported in accordance with OMB FISMA reporting requirements.
      - **PM-4b.** Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
PM-5:
  name: Information System Inventory
  family: Program Management
  description: |
    The organization develops and maintains an inventory of its information systems.
PM-6:
  name: Information Security Measures of Performance
  family: Program Management
  description: |
    The organization develops, monitors, and reports on the results of information security measures of performance.
PM-7:
  name: Enterprise Architecture
  family: Program Management
  description: |
    The organization develops an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
PM-8:
  name: Critical Infrastructure Plan
  family: Program Management
  description: |
    The organization addresses information security issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.
PM-9:
  name: Risk Management Strategy
  family: Program Management
  description: |
    The organization:
      - **PM-9a.** Develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems;
      - **PM-9b.** Implements the risk management strategy consistently across the organization; and
      - **PM-9c.** Reviews and updates the risk management strategy _[Assignment: organization-defined frequency]_ or as required, to address organizational changes.
PM-10:
  name: Security Authorization Process
  family: Program Management
  description: |
    The organization:
      - **PM-10a.** Manages (i.e., documents, tracks, and reports) the security state of organizational information systems and the environments in which those systems operate through security authorization processes;
      - **PM-10b.** Designates individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
      - **PM-10c.** Fully integrates the security authorization processes into an organization-wide risk management program.
PM-11:
  name: Mission/business Process Definition
  family: Program Management
  description: |
    The organization:
      - **PM-11a.** Defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
      - **PM-11b.** Determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until achievable protection needs are obtained.
PM-12:
  name: Insider Threat Program
  family: Program Management
  description: |
    The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.
PM-13:
  name: Information Security Workforce
  family: Program Management
  description: |
    The organization establishes an information security workforce development and improvement program.
PM-14:
  name: Testing, Training, and Monitoring
  family: Program Management
  description: |
    The organization:
      - **PM-14a.** Implements a process for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational information systems:
        - **PM-14a.1.** Are developed and maintained; and
        - **PM-14a.2.** Continue to be executed in a timely manner;
      - **PM-14b.** Reviews testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
PM-15:
  name: Contacts With Security Groups and Associations
  family: Program Management
  description: |
    The organization establishes and institutionalizes contact with selected groups and associations within the security community:
      - **PM-15a.** To facilitate ongoing security education and training for organizational personnel;
      - **PM-15b.** To maintain currency with recommended security practices, techniques, and technologies; and
      - **PM-15c.** To share current security-related information including threats, vulnerabilities, and incidents.
PM-16:
  name: Threat Awareness Program
  family: Program Management
  description: |
    The organization implements a threat awareness program that includes a cross-organization information-sharing capability.