About

Control Correlation Identifiers (CCIs) provide a standard identifier and description for each of the singular, actionable statements that comprise an IA control or IA best practice.

CCI List

The following CCI list was published to the DoD Cyber Exchange (formerly the Information Assurance Support Environment (IASE)) on June 27th, 2016 as version 2016-06-27 by the Cyber Directorate of the Defense Information Systems Agency (DISA) and was imported to this site on October 10th, 2021 for the convenience of Joval users and the broader security automation community.

CCI	Definition
CCI-001545	The organization defines a frequency for reviewing and updating the access control policy.
CCI-001546	The organization defines a frequency for reviewing and updating the access control procedures.
CCI-000001	The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000004	The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.
CCI-000002	The organization disseminates the access control policy to organization-defined personnel or roles.
CCI-000003	The organization reviews and updates the access control policy in accordance with organization-defined frequency.
CCI-000005	The organization disseminates the procedures to facilitate access control policy and associated access controls to the organization-defined personnel or roles.
CCI-000006	The organization reviews and updates the access control procedures in accordance with organization-defined frequency.
CCI-001547	The organization defines the frequency on which it will review information system accounts for compliance with account management requirements.
CCI-000007	The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary).
CCI-000008	The organization establishes conditions for group membership.
CCI-000009	The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges.
CCI-000010	The organization requires approvals by organization-defined personnel or roles for requests to create information system accounts.
CCI-000011	The organization creates, enables, modifies, disables, and removes information system accounts in accordance with organization-defined procedures or conditions.
CCI-000012	The organization reviews information system accounts for compliance with account management requirements per organization-defined frequency.
CCI-000013	The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes.
CCI-000014	The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions.
CCI-000015	The organization employs automated mechanisms to support the information system account management functions.
CCI-000016	The information system automatically removes or disables temporary accounts after an organization-defined time period for each type of account.
CCI-000017	The information system automatically disables inactive accounts after an organization-defined time period.
CCI-000018	The information system automatically audits account creation actions.
CCI-000019	The organization requires that users log out in accordance with the organization-defined time period of inactivity or description of when to log out.
CCI-000020	The information system dynamically manages user privileges and associated access authorizations.
CCI-000237	The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts.
CCI-000208	The organization determines normal time-of-day and duration usage for information system accounts.
CCI-001361	The organization defines a time period after which temporary accounts are automatically terminated.
CCI-001365	The organization defines a time period after which emergency accounts are automatically terminated.
CCI-000217	The organization defines a time period after which inactive accounts are automatically disabled.
CCI-001403	The information system automatically audits account modification actions.
CCI-001404	The information system automatically audits account disabling actions.
CCI-001405	The information system automatically audits account removal actions.
CCI-001406	The organization defines a time period of expected inactivity when users are required to log out.
CCI-001407	The organization administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles.
CCI-001354	The organization manages information system accounts by deactivating temporary accounts that are no longer required.
CCI-001355	The organization manages information system accounts by deactivating accounts of terminated or transferred users.
CCI-001356	The organization monitors for atypical usage of information system accounts.
CCI-001357	The organization reports atypical usage to designated organizational officials.
CCI-001358	The organization establishes privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles.
CCI-001359	The organization tracks privileged role assignments.
CCI-001360	The organization monitors privileged role assignments.
CCI-001682	The information system automatically removes or disables emergency accounts after an organization-defined time period for each type of account.
CCI-001683	The information system notifies organization-defined personnel or roles for account creation actions.
CCI-001684	The information system notifies organization-defined personnel or roles for account modification actions.
CCI-001685	The information system notifies organization-defined personnel or roles for account disabling actions.
CCI-001686	The information system notifies organization-defined personnel or roles for account removal actions.
CCI-001548	The organization defines the information flow control policies for controlling the flow of information within the system.
CCI-001549	The organization defines the information flow control policies for controlling the flow of information between interconnected systems.
CCI-001550	The organization defines approved authorizations for controlling the flow of information within the system.
CCI-001551	The organization defines approved authorizations for controlling the flow of information between interconnected systems.
CCI-001552	The organization defines policy that allows or disallows information flows based on changing conditions or operational considerations.
CCI-001553	The organization defines the security policy filters that privileged administrators have the capability to enable/disable.
CCI-001554	The organization defines the security policy filters that privileged administrators have the capability to configure.
CCI-001555	The information system uniquely identifies destination domains for information transfer.
CCI-001556	The information system uniquely authenticates destination domains for information transfer.
CCI-001557	The information system tracks problems associated with the information transfer.
CCI-000025	The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.
CCI-000026	The information system uses protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.
CCI-000027	The information system enforces dynamic information flow control based on organization-defined policies.
CCI-000028	The information system prevents encrypted information from bypassing content-checking mechanisms by employing organization-defined procedures or methods.
CCI-000029	The information system enforces organization-defined limitations on the embedding of data types within other data types.
CCI-000030	The information system enforces information flow control based on organization-defined metadata.
CCI-000031	The information system enforces organization-defined one-way flows using hardware mechanisms.
CCI-000032	The information system enforces information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.
CCI-000033	The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision.
CCI-000034	The information system provides the capability for a privileged administrator to enable/disable organization-defined security policy filters under organization-defined conditions.
CCI-000035	The information system provides the capability for privileged administrators to configure the organization-defined security policy filters to support different security policies.
CCI-000218	The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.
CCI-000219	The information system, when transferring information between different security domains, decomposes information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.
CCI-000221	The information system enforces security policies regarding information on interconnected systems.
CCI-000223	The information system binds security attributes to information to facilitate information flow policy enforcement.
CCI-000224	The information system tracks problems associated with the security attribute binding.
CCI-001414	The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.
CCI-001415	The organization defines limitations for the embedding of data types within other data types.
CCI-001416	The organization defines one-way information flows to be enforced by the information system.
CCI-001417	The organization defines security policy filters to be enforced by the information system and used as a basis for flow control decisions.
CCI-001418	The organization defines security policy filters for which the information system enforces the use of human review.
CCI-001368	The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
CCI-001371	The organization defines information security policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.
CCI-001372	The information system, when transferring information between different security domains, implements organization-defined security policy filters requiring fully enumerated formats that restrict data structure and content.
CCI-001373	The information system, when transferring information between different security domains, examines the information for the presence of organization-defined unsanctioned information.
CCI-001374	The information system, when transferring information between different security domains, prohibits the transfer of organization-defined unsanctioned information in accordance with the organization-defined security policy.
CCI-001376	The information system uniquely identifies source domains for information transfer.
CCI-001377	The information system uniquely authenticates source domains for information transfer.
CCI-001558	The organization defines the security functions (deployed in hardware, software, and firmware) for which access must be explicitly authorized.
CCI-000038	The organization explicitly authorizes access to organization-defined security functions and security-relevant information.
CCI-000039	The organization requires that users of information system accounts or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts, or roles, when accessing nonsecurity functions.
CCI-000040	The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.
CCI-000041	The organization authorizes network access to organization-defined privileged commands only for organization-defined compelling operational needs.
CCI-000042	The organization documents the rationale for authorized network access to organization-defined privileged commands in the security plan for the information system.
CCI-000225	The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
CCI-000226	The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.
CCI-001419	The organization defines the security functions or security-relevant information to which users of information system accounts, or roles, have access.
CCI-001420	The organization defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.
CCI-001421	The organization limits authorization to super user accounts on the information system to designated system administration personnel.
CCI-001422	The organization prohibits privileged access to the information system by non-organizational users.
CCI-001559	The organization identifies the individuals authorized to change the value of associated security attributes.
CCI-001560	The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined objects.
CCI-001424	The information system dynamically associates security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.
CCI-001425	The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.
CCI-001426	The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.
CCI-001427	The information system allows authorized users to associate security attributes with information.
CCI-001428	The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.
CCI-001429	The organization identifies special dissemination, handling, or distribution instructions for identifying security attributes on output.
CCI-001430	The organization identifies human-readable, standard naming conventions for identifying security attributes on output.
CCI-001396	The organization defines security attributes for which the information system supports and maintains the bindings for information in storage.
CCI-001397	The organization defines security attributes for which the information system supports and maintains the bindings for information in process.
CCI-001398	The organization defines security attributes for which the information system supports and maintains the bindings for information in transmission.
CCI-001399	The information system supports and maintains the binding of organization-defined security attributes to information in storage.
CCI-001400	The information system supports and maintains the binding of organization-defined security attributes to information in process.
CCI-001401	The information system supports and maintains the binding of organization-defined security attributes to information in transmission.
CCI-001561	The organization defines managed access control points for remote access to the information system.
CCI-001562	The organization defines the appropriate action(s) to be taken if an unauthorized remote connection is discovered.
CCI-000063	The organization defines allowed methods of remote access to the information system.
CCI-000064	The organization establishes usage restrictions and implementation guidance for each allowed remote access method.
CCI-000065	The organization authorizes remote access to the information system prior to allowing such connections.
CCI-000066	The organization enforces requirements for remote connections to the information system.
CCI-000067	The information system monitors remote access methods.
CCI-000068	The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.
CCI-000069	The information system routes all remote accesses through an organization-defined number of managed network access control points.
CCI-000070	The organization authorizes the execution of privileged commands via remote access only for organization-defined needs.
CCI-000071	The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.
CCI-000072	The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.
CCI-000079	The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures.
CCI-001431	The organization defines a frequency for monitoring for unauthorized remote connections to the information system.
CCI-001432	The organization takes appropriate action if an unauthorized remote connection to the information system is discovered.
CCI-001433	The organization defines a list of security functions and security-relevant information that for remote access sessions have organization-defined security measures employed and are audited.
CCI-001434	The organization defines additional security measures to be employed when an organization-defined list of security functions and security-relevant information is accessed remotely.
CCI-001435	The organization defines networking protocols within the information system deemed to be nonsecure.
CCI-001436	The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.
CCI-001437	The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system.
CCI-001453	The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.
CCI-001454	The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.
CCI-001455	The organization explicitly identifies components needed in support of specific operational requirements.
CCI-001402	The organization monitors for unauthorized remote access to the information system.
CCI-001563	The organization defines the appropriate action(s) to be taken if an unauthorized wireless connection is discovered.
CCI-001438	The organization establishes usage restrictions for wireless access.
CCI-001439	The organization establishes implementation guidance for wireless access.
CCI-001440	The organization monitors for unauthorized wireless access to the information system.
CCI-001441	The organization authorizes wireless access to the information system prior to allowing such connections.
CCI-001442	The organization enforces requirements for wireless connections to the information system.
CCI-001443	The information system protects wireless access to the system using authentication of users and/or devices.
CCI-001444	The information system protects wireless access to the system using encryption.
CCI-001445	The organization monitors for unauthorized wireless connections to the information system on an organization-defined frequency.
CCI-001446	The organization scans for unauthorized wireless access points on an organization-defined frequency.
CCI-001447	The organization defines a frequency of monitoring for unauthorized wireless connections to information system, including scans for unauthorized wireless access points.
CCI-001448	The organization takes appropriate action if an unauthorized wireless connection is discovered.
CCI-001449	The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
CCI-001450	The organization does not allow users to independently configure wireless networking capabilities.
CCI-001451	The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.
CCI-001564	The organization defines the frequency of security awareness and training policy reviews and updates.
CCI-001565	The organization defines the frequency of security awareness and training procedure reviews and updates.
CCI-000100	The organization develops and documents a security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000101	The organization disseminates a security awareness and training policy to organization-defined personnel or roles.
CCI-000102	The organization reviews and updates the current security awareness and training policy in accordance with organization-defined frequency.
CCI-000103	The organization develops and documents procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls.
CCI-000104	The organization disseminates security awareness and training procedures to organization-defined personnel or roles.
CCI-000105	The organization reviews and updates the current security awareness and training procedures in accordance with an organization-defined frequency.
CCI-001566	The organization provides organization-defined personnel or roles with initial training in the employment and operation of physical security controls.
CCI-001567	The organization provides organization-defined personnel or roles with refresher training in the employment and operation of physical security controls in accordance with the organization-defined frequency.
CCI-001568	The organization defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.
CCI-000108	The organization provides role-based security training to personnel with assigned security roles and responsibilities before authorizing access to the information system or performing assigned duties.
CCI-000109	The organization provides role-based security training to personnel with assigned security roles and responsibilities when required by information system changes.
CCI-000110	The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.
CCI-000111	The organization defines a frequency for providing refresher role-based security training.
CCI-001481	The organization provides organization-defined personnel or roles with initial training in the employment and operation of environmental controls.
CCI-001482	The organization provides organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency.
CCI-001483	The organization defines a frequency for providing employees with refresher training in the employment and operation of environmental controls.
CCI-001569	The organization defines the frequency on which it will review and update the audit and accountability policy.
CCI-001570	The organization defines the frequency on which it will review and update the audit and accountability procedures.
CCI-000117	The organization develops and documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000118	The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities.
CCI-000119	The organization reviews and updates the audit and accountability policy on an organization-defined frequency.
CCI-000120	The organization develops and documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
CCI-000121	The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities.
CCI-000122	The organization reviews and updates the audit and accountability procedures on an organization-defined frequency.
CCI-001571	The organization defines the information system auditable events.
CCI-000123	The organization determines the information system must be capable of auditing an organization-defined list of auditable events.
CCI-000124	The organization coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events.
CCI-000125	The organization provides a rationale for why the list of auditable events is deemed to be adequate to support after-the-fact investigations of security incidents.
CCI-000126	The organization determines that the organization-defined subset of the auditable events defined in AU-2 are to be audited within the information system.
CCI-000127	The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency.
CCI-000128	The organization includes execution of privileged functions in the list of events to be audited by the information system.
CCI-000129	The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.
CCI-001484	The organization defines frequency of (or situation requiring) auditing for each identified event.
CCI-001485	The organization defines the events which are to be audited on the information system on an organization-defined frequency of (or situation requiring) auditing for each identified event.
CCI-001486	The organization defines a frequency for reviewing and updating the list of organization-defined auditable events.
CCI-001572	The organization defines the personnel or roles to be alerted in the event of an audit processing failure.
CCI-001573	The organization defines whether to reject or delay network traffic that exceeds organization-defined thresholds.
CCI-001574	The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds.
CCI-000139	The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.
CCI-000140	The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).
CCI-000143	The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.
CCI-000144	The information system provides a real-time alert when organization-defined audit failure events occur.
CCI-000145	The information system enforces configurable network communications traffic volume thresholds reflecting limits on auditing capacity by delaying or rejecting network traffic which exceeds the organization-defined thresholds.
CCI-000146	The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided.
CCI-000147	The organization defines the audit failure events requiring real-time alerts.
CCI-001343	The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.
CCI-001490	The organization defines actions to be taken by the information system upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).
CCI-001575	The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.
CCI-000162	The information system protects audit information from unauthorized access.
CCI-000163	The information system protects audit information from unauthorized modification.
CCI-000164	The information system protects audit information from unauthorized deletion.
CCI-000165	The information system writes audit records to hardware-enforced, write-once media.
CCI-001348	The information system backs up audit records on an organization-defined frequency onto a different system or system component than the system or component being audited.
CCI-001349	The organization defines a frequency for backing up system audit records onto a different system or system component than the system or component being audited.
CCI-001350	The information system implements cryptographic mechanisms to protect the integrity of audit information.
CCI-001351	The organization authorizes access to management of audit functionality to only an organization-defined subset of privileged users.
CCI-001352	The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.
CCI-001493	The information system protects audit tools from unauthorized access.
CCI-001494	The information system protects audit tools from unauthorized modification.
CCI-001495	The information system protects audit tools from unauthorized deletion.
CCI-001496	The information system implements cryptographic mechanisms to protect the integrity of audit tools.
CCI-001576	The information system produces a system-wide (logical or physical) audit trail of information system audit records.
CCI-001577	The organization defines the information system components from which audit records are to be compiled into the system-wide audit trail.
CCI-000169	The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.
CCI-000171	The information system allows organization-defined personnel or roles to select which auditable events are to be audited by specific components of the information system.
CCI-000172	The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
CCI-000173	The organization defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.
CCI-000174	The information system compiles audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.
CCI-001459	The organization defines information system components that provide audit record generation capability.
CCI-001353	The information system produces a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
CCI-001578	The organization defines the frequency to review and update the current security assessment and authorization procedures.
CCI-000238	The organization defines the frequency to review and update the current security assessment and authorization policy.
CCI-000239	The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000240	The organization disseminates to organization-defined personnel or roles a security assessment and authorization policy.
CCI-000241	The organization reviews and updates the current security assessment and authorization policy in accordance with organization-defined frequency.
CCI-000242	The organization develops and documents procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls.
CCI-000243	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls.
CCI-000244	The organization reviews and updates the current security assessment and authorization procedures in accordance with organization-defined frequency.
CCI-001579	The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques.
CCI-000245	The organization develops a security assessment plan for the information system and its environment of operation.
CCI-000246	The organization's security assessment plan describes the security controls and control enhancements under assessment.
CCI-000247	The organization's security assessment plan describes assessment procedures to be used to determine security control effectiveness.
CCI-000248	The organization's security assessment plan describes assessment environment.
CCI-000249	The organizations security assessment plan describes the assessment team.
CCI-000250	The organization's security assessment plan describes assessment roles and responsibilities.
CCI-000251	The organization assesses, on an organization-defined frequency, the security controls in the information system and its environment of operation to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements.
CCI-000252	The organization defines the frequency on which the security controls in the information system and its environment of operation are assessed.
CCI-000253	The organization produces a security assessment report that documents the results of the assessment against the information system and its environment of operation.
CCI-000254	The organization provides the results of the security control assessment against the information system and its environment of operation to organization-defined individuals or roles.
CCI-000255	The organization employs assessors or assessment teams with an organization-defined level of independence to conduct security control assessments of organizational information systems.
CCI-000256	The organization includes, as part of security control assessments announced or unannounced, one or more of the following: in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; and organization-defined other forms of security assessment on an organization-defined frequency.
CCI-001580	The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary).
CCI-000257	The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements.
CCI-000258	The organization documents, for each interconnection, the interface characteristics.
CCI-000259	The organization documents, for each interconnection, the security requirements.
CCI-000260	The organization documents, for each interconnection, the nature of the information communicated.
CCI-000261	The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.
CCI-000262	The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device.
CCI-000263	The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device.
CCI-001581	The organization defines personnel or roles to whom the security status of the organization and the information system should be reported.
CCI-001582	The organization defines other forms of security assessments other than in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; and performance/load testing that should be included as part of security control assessments.
CCI-001583	The organization selects announced or unannounced assessments for each form of security control assessment.
CCI-000274	The organization develops a continuous monitoring strategy.
CCI-000275	The organization implements a continuous monitoring program that includes a configuration management process for the information system.
CCI-000276	The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components.
CCI-000277	The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system.
CCI-000278	The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation.
CCI-000279	The organization implements a continuous monitoring program that includes ongoing security control assessments in accordance with the organizational continuous monitoring strategy.
CCI-000280	The organization implements a continuous monitoring program that includes reporting the security status of the organization and the information system to organization-defined personnel or roles on an organization-defined frequency.
CCI-000281	The organization defines the frequency with which to report the security status of the organization and the information system to organization-defined personnel or roles.
CCI-000282	The organization employs assessors or assessment teams with an organization-defined level of independence to monitor the security controls in the information system on an ongoing basis.
CCI-000283	The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.
CCI-000284	The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.
CCI-000285	The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.
CCI-001681	The organization defines the frequency at which each form of security control assessment should be conducted.
CCI-001584	The organization defines the frequency with which to review and update configuration management procedures.
CCI-000286	The organization defines a frequency with which to review and update the configuration management policies.
CCI-000287	The organization develops and documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000288	The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities.
CCI-000289	The organization reviews and updates, on an organization-defined frequency, the configuration management policy.
CCI-000290	The organization develops and documents procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
CCI-000291	The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
CCI-000292	The organization reviews and updates, on an organization-defined frequency, the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
CCI-001585	The organization defines the circumstances that require reviews and updates to the baseline configuration of the information system.
CCI-000293	The organization develops a current baseline configuration of the information system.
CCI-000294	The organization documents a baseline configuration of the information system.
CCI-000295	The organization maintains, under configuration control, a current baseline configuration of the information system.
CCI-000296	The organization reviews and updates the baseline configuration of the information system at an organization-defined frequency.
CCI-000297	The organization reviews and updates the baseline configuration of the information system when required due to organization-defined circumstances.
CCI-000298	The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations.
CCI-000299	The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.
CCI-000300	The organization employs automated mechanisms to maintain a complete baseline configuration of the information system.
CCI-000301	The organization employs automated mechanisms to maintain an up-to-date baseline configuration of the information system.
CCI-000302	The organization employs automated mechanisms to maintain an accurate baseline configuration of the information system.
CCI-000303	The organization employs automated mechanisms to maintain a readily available baseline configuration of the information system.
CCI-000304	The organization retains organization-defined previous versions of baseline configurations of the information system to support rollback.
CCI-000305	The organization develops a list of software programs not authorized to execute on the information system.
CCI-000306	The organization maintains the list of software programs not authorized to execute on the information system.
CCI-000307	The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.
CCI-000308	The organization develops the list of software programs authorized to execute on the information system.
CCI-000309	The organization maintains the list of software programs authorized to execute on the information system.
CCI-000310	The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.
CCI-000311	The organization maintains a baseline configuration for information system development environments that is managed separately from the operational baseline configuration.
CCI-000312	The organization maintains a baseline configuration for information system test environments that is managed separately from the operational baseline configuration.
CCI-001497	The organization defines a frequency for the reviews and updates to the baseline configuration of the information system.
CCI-001586	The organization defines the configuration change control element (e.g., committee, board) responsible for coordinating and providing oversight for configuration change control activities.
CCI-000313	The organization determines the types of changes to the information system that are configuration controlled.
CCI-000314	The organization approves or disapproves configuration-controlled changes to the information system, with explicit consideration for security impact analysis.
CCI-000315	The organization documents approved configuration-controlled changes to the system.
CCI-000316	The organization retains records of configuration-controlled changes to the information system for an organization-defined time period.
CCI-000317	The organization reviews records of configuration-controlled changes to the system.
CCI-000318	The organization audits and reviews activities associated with configuration-controlled changes to the system.
CCI-000319	The organization coordinates and provides oversight for configuration change control activities through an organization-defined configuration change control element (e.g., committee, board) that convenes at the organization-defined frequency and/or for any organization-defined configuration change conditions.
CCI-000320	The organization defines the frequency with which to convene the configuration change control element.
CCI-000321	The organization defines configuration change conditions that prompt the configuration change control element to convene.
CCI-000322	The organization employs automated mechanisms to document proposed changes to the information system.
CCI-000323	The organization employs automated mechanisms to notify organization-defined approval authorities of proposed changes to the information system and request change approval.
CCI-000324	The organization employs automated mechanisms to highlight proposed changes to the information system that have not been approved or disapproved by an organization-defined time period.
CCI-000325	The organization employs automated mechanisms to prohibit changes to the information system until designated approvals are received.
CCI-000326	The organization employs automated mechanisms to document all changes to the information system.
CCI-000327	The organization tests changes to the information system before implementing the changes on the operational system.
CCI-000328	The organization validates changes to the information system before implementing the changes on the operational system.
CCI-000329	The organization documents changes to the information system before implementing the changes on the operational system.
CCI-000330	The organization employs automated mechanisms to implement changes to the current information system baseline.
CCI-000331	The organization deploys the updated information system baseline across the installed base.
CCI-000332	The organization requires an information security representative to be a member of the organization-defined configuration change control element.
CCI-001498	The organization defines a time period after which proposed changes to the information system that have not been approved or disapproved are highlighted.
CCI-001587	The organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CCI-000333	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
CCI-000334	The organization analyzes new software in a separate test environment before installation in an operational environment.
CCI-000335	The organization, after the information system is changed, checks the security functions to verify the functions are implemented correctly.
CCI-000336	The organization, after the information system is changed, checks the security functions to verify the functions are operating as intended.
CCI-000337	The organization, after the information system is changed, checks the security functions to verify the functions are producing the desired outcome with regard to meeting the security requirements for the system.
CCI-001588	The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.
CCI-001589	The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization’s incident response capability to ensure they are tracked.
CCI-000363	The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.
CCI-000364	The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.
CCI-000365	The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.
CCI-000366	The organization implements the security configuration settings.
CCI-000367	The organization identifies any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.
CCI-000368	The organization documents any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.
CCI-000369	The organization approves any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.
CCI-000370	The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.
CCI-000371	The organization employs automated mechanisms to centrally apply configuration settings for organization-defined information system components.
CCI-000372	The organization employs automated mechanisms to centrally verify configuration settings for organization-defined information system components.
CCI-000373	The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms.
CCI-000374	The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.
CCI-000375	The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability.
CCI-000376	The organization ensures unauthorized, security-relevant configuration changes detected are monitored.
CCI-000377	The organization ensures unauthorized, security-relevant configuration changes detected are corrected.
CCI-000378	The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes.
CCI-000379	The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment.
CCI-001502	The organization monitors changes to the configuration settings in accordance with organizational policies and procedures.
CCI-001503	The organization controls changes to the configuration settings in accordance with organizational policies and procedures.
CCI-001590	The organization develops a list of software programs authorized to execute on the information system.
CCI-001591	The organization develops a list of software programs not authorized to execute on the information system.
CCI-001592	The organization defines the rules authorizing the terms and conditions of software program usage on the information system.
CCI-001593	The organization maintains a list of software programs authorized to execute on the information system.
CCI-001594	The organization maintains a list of software programs not authorized to execute on the information system.
CCI-001595	The organization maintains rules authorizing the terms and conditions of software program usage on the information system.
CCI-000380	The organization defines prohibited or restricted functions, ports, protocols, and/or services for the information system.
CCI-000381	The organization configures the information system to provide only essential capabilities.
CCI-000382	The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.
CCI-000383	The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services.
CCI-000384	The organization reviews the information system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, and services.
CCI-000385	The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services.
CCI-000386	The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.
CCI-000387	The organization defines registration requirements for functions, ports, protocols, and services.
CCI-000388	The organization ensures compliance with organization-defined registration requirements for functions, ports, protocols, and services.
CCI-001596	The organization defines the frequency with which to review and update the current contingency planning procedures.
CCI-001597	The organization disseminates contingency planning procedures to organization-defined personnel or roles.
CCI-001598	The organization reviews and updates the current contingency planning procedures in accordance with the organization-defined frequency.
CCI-000437	The organization defines the frequency with which to review and update the current contingency planning policy.
CCI-000438	The organization develops and documents a contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000439	The organization disseminates a contingency planning policy to organization-defined personnel or roles.
CCI-000440	The organization reviews and updates the current contingency planning policy in accordance with an organization-defined frequency.
CCI-000441	The organization develops and documents procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.
CCI-001599	The organization sustains operational continuity of essential missions until full information system restoration at primary processing and/or storage sites.
CCI-001600	The organization sustains operational continuity of essential business functions until full information system restoration at primary processing and/or storage sites.
CCI-001601	The organization sustains operational continuity of essential missions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.
CCI-001602	The organization sustains operational continuity of essential business functions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.
CCI-000443	The organization develops a contingency plan for the information system that identifies essential missions.
CCI-000444	The organization develops a contingency plan for the information system that identifies essential business functions.
CCI-000445	The organization develops a contingency plan for the information system that identifies associated contingency requirements.
CCI-000446	The organization develops a contingency plan for the information system that provides recovery objectives.
CCI-000447	The organization develops a contingency plan for the information system that provides restoration priorities.
CCI-000448	The organization develops a contingency plan for the information system that provides metrics.
CCI-000449	The organization develops a contingency plan for the information system that addresses contingency roles, responsibilities, assigned individuals with contact information.
CCI-000450	The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption.
CCI-000451	The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption.
CCI-000452	The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise.
CCI-000453	The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise.
CCI-000454	The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure.
CCI-000455	The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure.
CCI-000456	The organization develops a contingency plan for the information system that addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented.
CCI-000457	The organization develops a contingency plan for the information system that is reviewed and approved by organization-defined personnel or roles.
CCI-000458	The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.
CCI-000459	The organization distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.
CCI-000460	The organization coordinates contingency planning activities with incident handling activities.
CCI-000461	The organization defines the frequency with which to review the contingency plan for the information system.
CCI-000462	The organization reviews the contingency plan for the information system in accordance with organization-defined frequency.
CCI-000463	The organization updates the contingency plan to address changes to the organization.
CCI-000464	The organization updates the contingency plan to address changes to the information system.
CCI-000465	The organization updates the contingency plan to address changes to the environment of operation.
CCI-000466	The organization updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.
CCI-000468	The organization communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.
CCI-000469	The organization coordinates contingency plan development with organizational elements responsible for related plans.
CCI-000470	The organization conducts capacity planning so that necessary capacity for information processing exists during contingency operations.
CCI-000471	The organization conducts capacity planning so that necessary capacity for telecommunications exists during contingency operations.
CCI-000472	The organization conducts capacity planning so that necessary capacity for environmental support exists during contingency operations.
CCI-000473	The organization defines the time period for planning the resumption of essential missions as a result of contingency plan activation.
CCI-000474	The organization defines the time period for planning the resumption of essential business functions as a result of contingency plan activation.
CCI-000475	The organization plans for the resumption of essential missions within the organization-defined time period of contingency plan activation.
CCI-000476	The organization plans for the resumption of essential business functions within the organization-defined time period of contingency plan activation.
CCI-000477	The organization defines the time period for planning the resumption of all missions as a result of contingency plan activation.
CCI-000478	The organization defines the time period for planning the resumption of all business functions as a result of contingency plan activation.
CCI-000479	The organization plans for the resumption of all missions within an organization-defined time period of contingency plan activation.
CCI-000480	The organization plans for the resumption of all business functions within an organization-defined time period of contingency plan activation.
CCI-000481	The organization plans for the continuance of essential missions with little or no loss of operational continuity.
CCI-000482	The organization plans for the continuance of essential business functions with little or no loss of operational continuity.
CCI-000483	The organization plans for the transfer of essential missions to alternate processing and/or storage sites with little or no loss of operational continuity.
CCI-000484	The organization plans for the transfer of essential business functions to alternate processing and/or storage sites with little or no loss of operational continuity.
CCI-001603	The contingency plan identifies the primary storage site hazards.
CCI-001604	The organization outlines explicit mitigation actions for organization identified accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.
CCI-000505	The organization establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information.
CCI-000506	The organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information.
CCI-000507	The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.
CCI-000508	The organization configures the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.
CCI-000509	The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.
CCI-001605	The contingency plan identifies the primary processing site hazards.
CCI-001606	The organization outlines explicit mitigation actions for organization-identified potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.
CCI-000510	The organization defines the time period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined information system operations at an alternate processing site when the primary processing capabilities are unavailable.
CCI-000511	The organization defines the time period for achieving the recovery time objectives for business functions within which processing must be resumed at the alternate processing site.
CCI-000512	The organization establishes an alternate processing site.
CCI-000513	The organization establishes an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined information system operations for essential missions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.
CCI-000514	The organization establishes an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined information system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.
CCI-000515	The organization ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption.
CCI-000516	The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.
CCI-000517	The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.
CCI-000518	The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with the organizational availability requirements (including recovery time objectives).
CCI-000519	The organization prepares the alternate processing site so that it is ready to be used as the operational site supporting essential missions.
CCI-000520	The organization prepares the alternate processing site so that it is ready to be used as the operational site supporting essential business functions.
CCI-000521	The organization ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.
CCI-001607	The organization establishes alternate telecommunications services to support the information system.
CCI-001608	The organization identifies the primary provider's telecommunications service hazards.
CCI-000522	The organization defines the time period within which to permit the resumption of organization-defined information system operations for essential missions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000523	The organization defines the time period within which to permit the resumption of organization-defined information system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000524	The organization establishes alternate telecommunication services including necessary agreements to permit the resumption of organization-defined information system operations for essential missions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000525	The organization establishes alternate telecommunication services including necessary agreements to permit the resumption of organization-defined information system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-000526	The organization develops primary telecommunications service agreements that contain priority-of-service provisions in accordance with the organization^s availability requirements (including recovery time objectives).
CCI-000527	The organization develops alternate telecommunications service agreements that contain priority-of-service provisions in accordance with the organization^s availability requirements (including recovery time objectives).
CCI-000528	The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary telecommunications services are provided by a common carrier.
CCI-000529	The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the alternate telecommunications services are provided by a common carrier.
CCI-000530	The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
CCI-000531	The organization obtains alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.
CCI-000532	The organization requires primary telecommunications service providers to have contingency plans.
CCI-000533	The organization requires alternate telecommunications service providers to have contingency plans.
CCI-001609	The organization can activate the redundant secondary information system that is not collocated with the primary system without loss of information or disruption to operations.
CCI-000534	The organization defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives.
CCI-000535	The organization conducts backups of user-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.
CCI-000536	The organization defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives.
CCI-000537	The organization conducts backups of system-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.
CCI-000538	The organization defines the frequency of conducting information system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives.
CCI-000539	The organization conducts backups of information system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.
CCI-000540	The organization protects the confidentiality, integrity, and availability of backup information at storage locations.
CCI-000541	The organization defines the frequency with which to test backup information to verify media reliability and information integrity.
CCI-000542	The organization tests backup information per an organization-defined frequency to verify media reliability and information integrity.
CCI-000543	The organization uses a sample of backup information in the restoration of selected information system functions as part of contingency plan testing.
CCI-000544	The organization stores backup copies of the operating system in a separate facility or in a fire-rated container that is not colocated with the operational system.
CCI-000545	The organization stores backup copies of critical information system software in a separate facility or in a fire-rated container that is not colocated with the operational system.
CCI-000546	The organization stores backup copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system.
CCI-000547	The organization defines the time period and transfer rate of the information system backup information to the alternate storage site consistent with the recovery time and recovery point objectives.
CCI-000548	The organization transfers information system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives.
CCI-000549	The organization maintains a redundant secondary information system that is not collocated with the primary system.
CCI-001610	The organization defines the time period (by authenticator type) for changing/refreshing authenticators.
CCI-001611	The organization defines the minimum number of special characters for password complexity enforcement.
CCI-001612	The organization defines the minimum number of upper case characters for password complexity enforcement.
CCI-001613	The organization defines the minimum number of lower case characters for password complexity enforcement.
CCI-001614	The organization defines the minimum number of numeric characters for password complexity enforcement.
CCI-001615	The organization defines the minimum number of characters that are changed when new passwords are created.
CCI-001616	The organization defines minimum password lifetime restrictions.
CCI-001617	The organization defines maximum password lifetime restrictions.
CCI-001618	The organization defines the number of generations for which password reuse is prohibited.
CCI-001619	The information system enforces password complexity by the minimum number of special characters used.
CCI-001620	The organization defines the types of and/or specific authenticators for which the registration process must be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).
CCI-001621	The organization implements organization-defined security safeguards to manage the risk of compromise due to individuals having accounts on multiple information systems.
CCI-000175	The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator.
CCI-000176	The organization manages information system authenticators by establishing initial authenticator content for authenticators defined by the organization.
CCI-000177	The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators.
CCI-000178	The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation.
CCI-000179	The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators.
CCI-000180	The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.
CCI-000181	The organization manages information system authenticators by establishing reuse conditions for authenticators.
CCI-000182	The organization manages information system authenticators by changing/refreshing authenticators in accordance with the organization-defined time period by authenticator type.
CCI-000183	The organization manages information system authenticators by protecting authenticator content from unauthorized disclosure.
CCI-000184	The organization manages information system authenticators by requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators.
CCI-000185	The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
CCI-000186	The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.
CCI-000187	The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.
CCI-000188	The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).
CCI-000189	The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators.
CCI-000190	The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery.
CCI-000191	The organization enforces password complexity by the number of special characters used.
CCI-000201	The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.
CCI-000202	The organization ensures unencrypted static authenticators are not embedded in access scripts.
CCI-000204	The organization defines the security safeguards required to manage the risk of compromise due to individuals having accounts on multiple information systems.
CCI-000192	The information system enforces password complexity by the minimum number of upper case characters used.
CCI-000193	The information system enforces password complexity by the minimum number of lower case characters used.
CCI-000194	The information system enforces password complexity by the minimum number of numeric characters used.
CCI-000195	The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.
CCI-000196	The information system, for password-based authentication, stores only cryptographically-protected passwords.
CCI-000197	The information system, for password-based authentication, transmits only cryptographically-protected passwords.
CCI-000198	The information system enforces minimum password lifetime restrictions.
CCI-000199	The information system enforces maximum password lifetime restrictions.
CCI-000200	The information system prohibits password reuse for the organization-defined number of generations.
CCI-000203	The organization ensures unencrypted static authenticators are not stored on function keys.
CCI-000205	The information system enforces minimum password length.
CCI-001544	The organization manages information system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.
CCI-001622	The organization identifies personnel with incident response roles and responsibilities with respect to the information system.
CCI-001623	The incident response training material addresses the procedures and activities necessary to fulfill identified organizational incident response roles and responsibilities.
CCI-000813	The organization provides incident response training to information system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.
CCI-000814	The organization provides incident response training in accordance with organization-defined frequency.
CCI-000815	The organization defines a frequency for incident response training.
CCI-000816	The organization incorporates simulated events into incident response training to facilitate effective response by personnel in crisis situations.
CCI-000817	The organization employs automated mechanisms to provide a more thorough and realistic incident response training environment.
CCI-001624	The organization documents the results of incident response tests.
CCI-000818	The organization tests the incident response capability for the information system on an organization-defined frequency using organization-defined tests to determine the incident response effectiveness.
CCI-000819	The organization defines a frequency for incident response tests.
CCI-000820	The organization defines tests for incident response.
CCI-000821	The organization employs automated mechanisms to more thoroughly and effectively test the incident response capability.
CCI-001625	The organization implements the resulting incident handling activity changes to incident response procedures, training, and testing/exercises accordingly.
CCI-000822	The organization implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery.
CCI-000823	The organization coordinates incident handling activities with contingency planning activities.
CCI-000824	The organization incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises.
CCI-000825	The organization employs automated mechanisms to support the incident handling process.
CCI-000826	The organization includes dynamic reconfiguration of organization-defined information system components as part of the incident response capability.
CCI-000827	The organization defines and identifies classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions.
CCI-000828	The organization defines and identifies actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions.
CCI-000829	The organization correlates incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
CCI-000830	The organization defines security violations that, if detected, initiate a configurable capability to automatically disable the information system.
CCI-000831	The organization implements a configurable capability to automatically disable the information system if organization-defined security violations are detected.
CCI-001626	The organization employs automated mechanisms to assist in the collection of security incident information.
CCI-001627	The organization employs automated mechanisms to assist in the analysis of security incident information.
CCI-000832	The organization tracks and documents information system security incidents.
CCI-000833	The organization employs automated mechanisms to assist in the tracking of security incidents.
CCI-001628	The organization defines a frequency with which to review and update the current system maintenance procedures.
CCI-000854	The organization reviews and updates the current system maintenance policy in accordance with organization-defined frequency.
CCI-000855	The organization develops and documents procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.
CCI-000856	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.
CCI-000857	The organization reviews and updates the current system maintenance procedures in accordance with organization-defined frequency.
CCI-000851	The organization defines the frequency with which to review and update the current system maintenance policy.
CCI-000852	The organization develops and documents a system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000853	The organization disseminates to organization-defined personnel or roles a system maintenance policy.
CCI-001629	The organization employs automated mechanisms to produce up-to-date, accurate, complete, and available records of all maintenance and repair actions needed, in process, and complete.
CCI-000858	The organization schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-000859	The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.
CCI-000860	The organization requires that organization-defined personnel or roles explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.
CCI-000861	The organization sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs.
CCI-000862	The organization checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions.
CCI-000863	The organization maintains maintenance records for the information system that include the date and time of maintenance, the name of the individual performing the maintenance, the name of escort, if necessary, a description of the maintenance performed, and a list of equipment removed or replaced (including identification numbers, if applicable).
CCI-000864	The organization employs automated mechanisms to schedule, conduct, and document maintenance and repairs as required.
CCI-001630	Designated organizational personnel review the maintenance records of the non-local maintenance and diagnostic sessions.
CCI-001631	The organization, before removal from organizational facilities, and after the service is performed, inspects and sanitizes the component (with regard to potentially malicious software) before reconnecting the component to the information system.
CCI-001632	The organization protects nonlocal maintenance sessions by separating the maintenance session from other network sessions with the information system by either physically separated communications paths or logically separated communications paths based upon encryption.
CCI-000873	The organization approves nonlocal maintenance and diagnostic activities.
CCI-000874	The organization monitors nonlocal maintenance and diagnostic activities.
CCI-000875	The organization controls non-local maintenance and diagnostic activities.
CCI-000876	The organization allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system.
CCI-000877	The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
CCI-000878	The organization maintains records for nonlocal maintenance and diagnostic activities.
CCI-000879	The organization terminates sessions and network connections when nonlocal maintenance is completed.
CCI-000880	The organization audits non-local maintenance and diagnostic sessions.
CCI-000881	The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.
CCI-000882	The organization requires that nonlocal maintenance and diagnostic services be performed from an information system that implements a security capability comparable to the capability implemented on the system being serviced.
CCI-000883	The organization removes the component to be serviced from the information system and prior to nonlocal maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities.
CCI-000884	The organization protects nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.
CCI-000885	The organization requires that maintenance personnel notify organization-defined personnel when non-local maintenance is planned (i.e., date/time).
CCI-000886	The organization defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance.
CCI-000887	The organization requires the approval of each nonlocal maintenance session by organization-defined personnel or roles.
CCI-000888	The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.
CCI-000889	The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions.
CCI-001633	The organization defines removable media types and information output requiring marking.
CCI-001010	The organization marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.
CCI-001011	The organization exempts organization-defined types of information system media from marking as long as the media remain within organization-defined controlled areas.
CCI-001012	The organization defines types of information system media to exempt from marking as long as the media remain within organization-defined controlled areas.
CCI-001013	The organization defines controlled areas where organization-defined types of information system media are exempt from being marked.
CCI-001634	The organization identifies authorized personnel with appropriate clearances and access authorizations for gaining physical access to the facility containing an information system that processes classified information.
CCI-001635	The organization removes individuals from the facility access list when access is no longer required.
CCI-000912	The organization develops a list of individuals with authorized access to the facility where the information system resides.
CCI-000913	The organization issues authorization credentials for facility access.
CCI-000914	The organization reviews the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.
CCI-000915	The organization defines the frequency with which to review the access list detailing authorized facility access by individuals.
CCI-000916	The organization authorizes physical access to the facility where the information system resides based on position or role.
CCI-000917	The organization requires two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the information system resides.
CCI-000918	The organization restricts physical access to the facility containing an information system that processes classified information to authorized personnel with appropriate clearances and access authorizations.
CCI-001636	The organization defines the frequency with which to review and update the current security planning policy.
CCI-001637	The organization reviews and updates the current security planning policy in accordance with organization-defined frequency.
CCI-001638	The organization defines the frequency with which to review and update the current security planning procedures.
CCI-000563	The organization develops and documents a security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000564	The organization disseminates a security planning policy to organization-defined personnel or roles.
CCI-000565	The organization reviews/updates, per organization-defined frequency, a formal, documented security planning policy.
CCI-000566	The organization develops and documents procedures to facilitate the implementation of the security planning policy and associated security planning controls.
CCI-000567	The organization disseminates security planning procedures to organization-defined personnel or roles.
CCI-000568	The organization reviews and updates the current security planning procedures in accordance with organization-defined frequency.
CCI-001639	The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.
CCI-000592	The organization establishes the rules describing the responsibilities and expected behavior, with regard to information and information system usage, for individuals requiring access to the information system.
CCI-000593	The organization receives a signed acknowledgment from individuals requiring access to the information system, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.
CCI-000594	The organization includes in the rules of behavior explicit restrictions on the use of social media/networking sites.
CCI-000595	The organization includes in the rules of behavior explicit restrictions on posting organizational information on public websites.
CCI-000596	The organization includes in the rules of behavior, explicit restrictions on sharing information system account information.
CCI-001640	The organization updates the critical infrastructure and key resources protection plan that addresses information security issues.
CCI-000216	The organization develops and documents a critical infrastructure and key resource protection plan that addresses information security issues.
CCI-001641	The organization defines the process for conducting random vulnerability scans on the information system and hosted applications.
CCI-001643	The organization scans for vulnerabilities in the information system and hosted applications in accordance with the organization-defined process for random scans.
CCI-001644	The organization employs vulnerability scanning procedures that can demonstrate the depth of coverage (i.e., vulnerabilities checked).
CCI-001645	The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities.
CCI-001054	The organization scans for vulnerabilities in the information system and hosted applications on an organization-defined frequency.
CCI-001055	The organization defines a frequency for scanning for vulnerabilities in the information system and hosted applications.
CCI-001056	The organization scans for vulnerabilities in the information system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.
CCI-001057	The organization employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations; formatting checklists and test procedures; and measuring vulnerability impact.
CCI-001058	The organization analyzes vulnerability scan reports and results from security control assessments.
CCI-001059	The organization remediates legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.
CCI-001060	The organization defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.
CCI-001061	The organization shares information obtained from the vulnerability scanning process and security control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
CCI-001062	The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.
CCI-001063	The organization updates the information system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported.
CCI-001064	The organization defines a frequency for updating the information system vulnerabilities scanned.
CCI-001065	The organization employs vulnerability scanning procedures that can demonstrate the breadth of coverage (i.e., information system components scanned).
CCI-001066	The organization determines what information about the information system is discoverable by adversaries.
CCI-001067	The information system implements privileged access authorization to organization-identified information system components for selected organization-defined vulnerability scanning activities.
CCI-001068	The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.
CCI-001069	The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.
CCI-001070	The organization defines a frequency for employing automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials.
CCI-001071	The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
CCI-001072	The organization employs an independent penetration agent or penetration team to conduct a vulnerability analysis on the information system.
CCI-001073	The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system based on the vulnerability analysis to determine the exploitability of identified vulnerabilities.
CCI-001642	The organization defines the organizational document in which risk assessment results are documented (e.g., security plan, risk assessment report).
CCI-001048	The organization conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction.
CCI-001049	The organization documents risk assessment results in the organization-defined document.
CCI-001050	The organization reviews risk assessment results on an organization-defined frequency.
CCI-001051	The organization defines a frequency for reviewing risk assessment results.
CCI-001052	The organization updates the risk assessment on an organization-defined frequency or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.
CCI-001053	The organization defines a frequency for updating the risk assessment.
CCI-000608	The organization includes a determination of information security requirements for the information system in mission process planning.
CCI-000609	The organization includes a determination of information security requirements for the information system in business process planning.
CCI-000610	The organization determines the resources required to protect the information system or information system service as part of its capital planning and investment control process.
CCI-000611	The organization documents the resources required to protect the information system or information system service as part of its capital planning and investment control process.
CCI-000612	The organization allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process.
CCI-000613	The organization establishes a discrete line item for information security in organizational programming documentation.
CCI-000614	The organization establishes a discrete line item for information security in organizational budgeting documentation.
CCI-001647	The organization requires the use of a FIPS-validated, cryptographic module for a technology product that relies on cryptographic functionality to enforce its security policy when no U.S. Government Protection Profile exists for such a specific technology type.
CCI-000619	The organization includes security functional requirements/specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
CCI-000620	The organization includes security-related documentation requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
CCI-000621	The organization includes developmental and evaluation-related assurance requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
CCI-000623	The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.
CCI-000624	The organization requires in acquisition documents that vendors/contractors provide information describing the design details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.
CCI-000625	The organization requires in acquisition documents that vendors/contractors provide information describing the implementation details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.
CCI-000626	The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs state-of-the-practice software and security engineering methods.
CCI-000627	The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs quality control processes.
CCI-000628	The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development processes employ validation techniques.
CCI-000629	The organization ensures each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment.
CCI-000630	The organization requires in acquisition documents, that information system components are delivered in a secure, documented configuration, and that the secure configuration is the default configuration for any software reinstalls or upgrades.
CCI-000631	The organization employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
CCI-000632	The organization employs only commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
CCI-000633	The organization ensures that government off-the-shelf (GOTS) or commercial-off-the-shelf(COTS) information assurance (IA) and IA-enabled information technology products have been evaluated and/or validated by the NSA or in accordance with NSA-approved procedures.
CCI-000634	The organization limits the use of commercially provided information assurance (IA) and IA-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance Partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.
CCI-000635	The organization requires, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated.
CCI-001648	The organization makes available to authorized personnel the source code for the information system to permit analysis and testing.
CCI-000636	The organization obtains administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
CCI-000637	The organization protects, as required, administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
CCI-000638	The organization makes available to authorized personnel administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
CCI-000639	The organization obtains user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.
CCI-000640	The organization protects, as required, user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.
CCI-000641	The organization makes available to authorized personnel user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.
CCI-000642	The organization documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent.
CCI-000643	The organization obtains vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.
CCI-000644	The organization protects, as required, vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system.
CCI-000645	The organization makes available to authorized personnel vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.
CCI-000646	The organization obtains vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.
CCI-000647	The organization obtains vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.
CCI-000648	The organization protects, as required, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system.
CCI-000650	The organization obtains vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.
CCI-000651	The organization protects, as required, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system.
CCI-000653	The organization obtains the source code for the information system to permit analysis and testing.
CCI-000654	The organization protects, as required, the source code for the information system to permit analysis and testing.
CCI-001690	The organization protects, as required, vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system.
CCI-001691	The organization makes available to authorized personnel vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.
CCI-001692	The organization makes available to authorized personnel vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.
CCI-001649	The organization identifies and documents (as appropriate) explicit rules to be enforced when governing the installation of software by users.
CCI-000663	The organization (or information system) enforces explicit rules governing the installation of software by users.
CCI-001650	The organization requires the information system developers to manage and control changes to the information system during development.
CCI-001651	The organization requires the information system integrators to manage and control changes to the information system during development.
CCI-001652	The organization requires the information system developers to manage and control changes to the information system during implementation.
CCI-001653	The organization requires the information system integrators to manage and control changes to the information system during implementation.
CCI-001654	The organization requires the information system developers to manage and control changes to the information system during modification.
CCI-001655	The organization requires the information system integrators to manage and control changes to the information system during modification.
CCI-000682	The organization requires information system developers to perform configuration management during information system design.
CCI-000683	The organization requires information system developers to perform configuration management during information system development.
CCI-000684	The organization requires information system developers to perform configuration management during information system implementation.
CCI-000685	The organization requires information system developers to perform configuration management during information system operation.
CCI-000686	The organization requires information system integrators to perform configuration management during information system design.
CCI-000687	The organization requires information system integrators to perform configuration management during information system development.
CCI-000688	The organization requires information system integrators to perform configuration management during information system implementation.
CCI-000689	The organization requires information system integrators to perform configuration management during information system operation.
CCI-000690	The organization requires information system developers to manage and control changes to the information system during design.
CCI-000691	The organization requires information system integrators to manage and control changes to the information system during design.
CCI-000692	The organization requires the developer of the information system, system component, or information system service to implement only organization-approved changes to the system, component, or service.
CCI-000693	The organization requires information system integrators to implement only organization-approved changes.
CCI-000694	The organization requires the developer of the information system, system component, or information system service to document approved changes to the system, component, or service.
CCI-000695	The organization requires information system integrators to document approved changes to the information system.
CCI-000696	The organization requires that information system developers track security flaws and flaw resolution.
CCI-000697	The organization requires information system integrators to track security flaws and flaw resolution.
CCI-000698	The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.
CCI-000699	The organization requires information system integrators to provide an integrity check of software to facilitate organizational verification of software integrity after delivery.
CCI-000700	The organization provides an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
CCI-000701	The organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated integrator configuration management team.
CCI-001656	The organization defines the security functions of the information system to be isolated from nonsecurity functions.
CCI-001084	The information system isolates security functions from nonsecurity functions.
CCI-001085	The information system utilizes underlying hardware separation mechanisms to implement security function isolation.
CCI-001086	The information system isolates security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.
CCI-001087	The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions.
CCI-001088	The organization implements security functions as largely independent modules that avoid unnecessary interactions between modules.
CCI-001089	The organization implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
CCI-001657	The organization defines the external boundary of the information system.
CCI-001658	The organization defines key internal boundaries of the information system.
CCI-001659	The organization defines the mediation necessary for public access to the organization's internal networks.
CCI-001660	The organization defines the measures to protect against unauthorized physical connections across boundary protections implemented at organization-defined managed interfaces.
CCI-001097	The information system monitors and controls communications at the external boundary of the information system and at key internal boundaries within the system.
CCI-001098	The information system connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
CCI-001099	The organization physically allocates publicly accessible information system components to separate subnetworks with separate physical network interfaces.
CCI-001100	The information system prevents public access into the organization's internal networks except as appropriately mediated by managed interfaces employing boundary protection devices.
CCI-001101	The organization limits the number of external network connections to the information system.
CCI-001102	The organization implements a managed interface for each external telecommunication service.
CCI-001103	The organization establishes a traffic flow policy for each managed interface for each external telecommunication service.
CCI-001104	The organization employs security controls as needed to protect the confidentiality and integrity of the information being transmitted.
CCI-001105	The organization documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need for each external telecommunication service.
CCI-001106	The organization reviews exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service.
CCI-001107	The organization defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service.
CCI-001108	The organization removes traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.
CCI-001109	The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).
CCI-001110	The organization prevents the unauthorized release of information outside of the information system boundary or any unauthorized communication through the information system boundary when there is an operational failure of the boundary protection mechanisms.
CCI-001111	The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks.
CCI-001112	The information system routes organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces.
CCI-001113	The organization defines the internal communications traffic to be routed to external networks.
CCI-001114	The organization defines the external networks to which organization-defined internal communications traffic should be routed.
CCI-001115	The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems.
CCI-001116	The organization prevents the unauthorized exfiltration of information across managed interfaces.
CCI-001117	The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination.
CCI-001118	The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices.
CCI-001119	The organization isolates organization-defined information security tools, mechanisms, and support components from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
CCI-001120	The organization defines key information security tools, mechanisms, and support components to be isolated.
CCI-001121	The organization protects against unauthorized physical connections at organization-defined managed interfaces.
CCI-001122	The organization defines the managed interfaces where boundary protections against unauthorized physical connections are to be implemented.
CCI-001123	The information system routes all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
CCI-001124	The information system prevents discovery of specific system components composing a managed interface.
CCI-001125	The information system enforces adherence to protocol format.
CCI-001126	The information system fails securely in the event of an operational failure of a boundary protection device.
CCI-001661	The organization defines the security functions, to minimally include information system authentication and re-authentication, within the information system to be included in a trusted communications path.
CCI-001135	The information system establishes a trusted communications path between the user and organization-defined security functions within the information system.
CCI-001136	The organization defines security functions include information system authentication and reauthentication.
CCI-001662	The information system takes organization-defined corrective action when organization-defined unacceptable mobile code is identified.
CCI-001162	The organization establishes implementation guidance for acceptable mobile code and mobile code technologies.
CCI-001163	The organization authorizes the use of mobile code within the information system.
CCI-001164	The organization monitors the use of mobile code within the information system.
CCI-001165	The organization controls the use of mobile code within the information system.
CCI-001166	The information system identifies organization-defined unacceptable mobile code.
CCI-001167	The organization ensures the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements.
CCI-001168	The organization defines requirements for the acquisition, development, and use of mobile code.
CCI-001169	The information system prevents the download of organization-defined unacceptable mobile code.
CCI-001170	The information system prevents the automatic execution of mobile code in organization-defined software applications.
CCI-001171	The organization defines software applications in which automatic mobile code execution is to be prohibited.
CCI-001172	The organization defines actions to be enforced by the information system before executing mobile code.
CCI-001160	The organization defines acceptable and unacceptable mobile code and mobile code technologies.
CCI-001161	The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.
CCI-001687	The organization ensures the use of mobile code to be deployed in information systems meets organization-defined mobile code requirements.
CCI-001688	The organization ensures the acquisition of mobile code to be deployed in information systems meets organization-defined mobile code requirements.
CCI-001695	The information system prevents the execution of organization-defined unacceptable mobile code.
CCI-001663	The information system, when operating as part of a distributed, hierarchical namespace, provides the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services).
CCI-001178	The information system provides additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
CCI-001179	The information system, when operating as part of a distributed, hierarchical namespace, provides the means to indicate the security status of child zones.
CCI-001664	The information system recognizes only session identifiers that are system-generated.
CCI-001184	The information system protects the authenticity of communications sessions.
CCI-001185	The information system invalidates session identifiers upon user logout or other session termination.
CCI-001186	The information system provides a readily observable logout capability whenever authentication is used to gain access to web pages.
CCI-001187	The information system generates a unique session identifier for each session.
CCI-001188	The information system generates unique session identifiers for each session with organization-defined randomness requirements.
CCI-001189	The organization defines randomness requirements for generating unique session identifiers.
CCI-001665	The information system preserves organization-defined system state information in the event of a system failure.
CCI-001190	The information system fails to an organization-defined known-state for organization-defined types of failures.
CCI-001191	The organization defines the known states the information system should fail to in the event of an organization-defined system failure.
CCI-001192	The organization defines types of failures for which the information system should fail to an organization-defined known state.
CCI-001193	The organization defines system state information that should be preserved in the event of a system failure.
CCI-001666	The organization employs cryptographic mechanisms to prevent unauthorized modification of information at rest unless otherwise protected by alternative physical measures.
CCI-001199	The information system protects the confidentiality and/or integrity of organization-defined information at rest.
CCI-001200	The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.
CCI-001667	The organization compares the time measured between flaw identification and flaw remediation with organization-defined benchmarks.
CCI-001225	The organization identifies information system flaws.
CCI-001226	The organization reports information system flaws.
CCI-001227	The organization corrects information system flaws.
CCI-001228	The organization tests software updates related to flaw remediation for effectiveness before installation.
CCI-001229	The organization tests software updates related to flaw remediation for potential side effects before installation.
CCI-001230	The organization incorporates flaw remediation into the organizational configuration management process.
CCI-001231	The organization centrally manages the flaw remediation process.
CCI-001232	The organization installs software updates automatically.
CCI-001233	The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.
CCI-001234	The organization defines a frequency for employing automated mechanisms to determine the state of information system components with regard to flaw remediation.
CCI-001235	The organization measures the time between flaw identification and flaw remediation.
CCI-001236	The organization defines benchmarks for the time taken to apply corrective actions after flaw identification.
CCI-001237	The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components.
CCI-001238	The organization defines information system components for which automated patch management tools are to be employed to facilitate flaw remediation.
CCI-001668	The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.
CCI-001669	The organization defines the frequency of testing malicious code protection mechanisms.
CCI-001239	The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.
CCI-001240	The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.
CCI-001241	The organization configures malicious code protection mechanisms to perform periodic scans of the information system on an organization-defined frequency.
CCI-001242	The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.
CCI-001243	The organization configures malicious code protection mechanisms to perform organization-defined action(s) in response to malicious code detection.
CCI-001244	The organization defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators.
CCI-001245	The organization addresses the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the information system.
CCI-001246	The organization centrally manages malicious code protection mechanisms.
CCI-001247	The information system automatically updates malicious code protection mechanisms.
CCI-001248	The information system prevents non-privileged users from circumventing malicious code protection capabilities.
CCI-001249	The information system updates malicious code protection mechanisms only when directed by a privileged user.
CCI-001250	The organization does not allow users to introduce removable media into the information system.
CCI-001251	The organization tests malicious code protection mechanisms on an organization-defined frequency by introducing a known benign, non-spreading test case into the information system.
CCI-001670	The information system takes organization-defined least-disruptive actions to terminate suspicious events.
CCI-001671	The organization analyzes outbound communications traffic at selected organization-defined interior points within the system (e.g., subnetworks, subsystems) to discover anomalies.
CCI-001672	The organization employs a wireless intrusion detection system to identify rogue wireless devices.
CCI-001673	The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.
CCI-001252	The organization monitors events on the information system in accordance with organization-defined monitoring objectives and detects information system attacks.
CCI-001253	The organization defines the objectives of monitoring for attacks and indicators of potential attacks on the information system.
CCI-001254	The organization identifies unauthorized use of the information system.
CCI-001255	The organization deploys monitoring devices strategically within the information system to collect organization-determined essential information.
CCI-001256	The organization deploys monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.
CCI-001257	The organization heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.
CCI-001258	The organization obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.
CCI-001259	The organization interconnects and configures individual intrusion detection tools into a systemwide intrusion detection system using common protocols.
CCI-001260	The organization employs automated tools to support near real-time analysis of events.
CCI-001261	The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.
CCI-001262	The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions.
CCI-001263	The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs.
CCI-001264	The organization defines indicators of compromise or potential compromise to the security of the information system which will result in information system alerts being provided to organization-defined personnel or roles.
CCI-001265	The information system prevents non-privileged users from circumventing intrusion detection and prevention capabilities.
CCI-001266	The information system notifies an organization-defined list of incident response personnel (identified by name and/or by role) of detected suspicious events.
CCI-001267	The organization defines a list of incident response personnel (identified by name and/or by role) to be notified of detected suspicious events.
CCI-001268	The organization defines a list of least-disruptive actions to be taken by the information system to terminate suspicious events.
CCI-001269	The organization protects information obtained from intrusion monitoring tools from unauthorized access, modification, and deletion.
CCI-001270	The organization tests intrusion monitoring tools at an organization-defined frequency.
CCI-001271	The organization defines the frequency for testing intrusion monitoring tools.
CCI-001272	The organization makes provisions so encrypted traffic is visible to information system monitoring tools.
CCI-001273	The organization analyzes outbound communications traffic at the external boundary of the information system to discover anomalies.
CCI-001274	The organization employs automated mechanisms to alert security personnel of organization-defined inappropriate or unusual activities with security implications.
CCI-001275	The organization defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities.
CCI-001276	The organization analyzes communications traffic/event patterns for the information system.
CCI-001277	The organization develops profiles representing common traffic patterns and/or events.
CCI-001278	The organization uses the traffic/event profiles in tuning system monitoring devices to reduce the number of false positives to an organization-defined measure of false positives and the number of false negatives to an organization-defined measure of false negatives.
CCI-001279	The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false positives.
CCI-001280	The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false negatives.
CCI-001281	The organization employs a wireless intrusion detection system.
CCI-001282	The organization employs an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
CCI-001283	The organization correlates information from monitoring tools employed throughout the information system.
CCI-001284	The organization correlates information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
CCI-001674	The information system responds to security function anomalies in accordance with organization-defined responses and alternative action(s).
CCI-001675	The organization defines the personnel or roles that are to receive reports on the results of security function verification.
CCI-001676	The organization defines, for periodic security function verification, the frequency of the verifications.
CCI-001291	The information system verifies the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification).
CCI-001292	The organization defines the appropriate conditions, including the system transitional states if applicable, for verifying the correct operation of security functions.
CCI-001293	The organization defines the information system responses and alternative action(s) to anomalies discovered during security function verification.
CCI-001294	The information system notifies organization-defined personnel or roles of failed security verification tests.
CCI-001295	The information system implements automated mechanisms to support the management of distributed security testing.
CCI-001296	The organization reports the results of security function verification to organization-defined personnel or roles.
CCI-001677	The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
CCI-001305	The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
CCI-001306	The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
CCI-001307	The organization centrally manages spam protection mechanisms.
CCI-001308	The information system automatically updates spam protection mechanisms.
CCI-001678	The organization retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
CCI-001315	The organization handles information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
CCI-001679	The organization provides a mechanism to exchange active and standby roles of the components.
CCI-001316	The organization protects the information system from harm by considering mean time to failure rates for an organization-defined list of information system components in specific environments of operation.
CCI-001317	The organization defines a list of information system components for which mean time to failure rates should be considered to protect the information system from harm.
CCI-001318	The organization provides substitute information system components.
CCI-001319	The organization takes information system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).
CCI-001320	The organization defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when information system components are taken out of service by transferring component responsibilities to substitute components.
CCI-001321	The organization does not allow a process to execute without supervision for more than an organization-defined time period.
CCI-001322	The organization defines a time period that is the longest a process is allowed to execute without supervision.
CCI-001323	The organization manually initiates a transfer between active and standby information system components in accordance with organization-defined frequency if the mean time to failure (MTTF) exceeds an organization-defined time period.
CCI-001324	The organization defines the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure (MTTF) exceeds the organization-defined time period.
CCI-001325	The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components.
CCI-001326	The organization, if information system component failures are detected, ensures standby components are successfully and transparently installed within an organization-defined time period.
CCI-001327	The organization defines a time period for a standby information system component to be successfully and transparently installed for the information system component that has failed.
CCI-001328	The organization, if an information system component failure is detected, activates an organization-defined alarm and/or automatically shuts down the information system.
CCI-001329	The organization defines the alarm to be activated when an information system component failure is detected.
CCI-001689	The organization, if an information system component failure is detected, automatically shuts down the information system.
CCI-001680	The organization develops an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000023	The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan, and a determination of the risk to be incurred if the plan is implemented as intended.
CCI-000073	The organization develops an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.
CCI-000074	The organization develops an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.
CCI-000075	The organization reviews the organization-wide information security program plan on an organization-defined frequency.
CCI-000076	The organization defines the frequency with which to review the organization-wide information security program plan.
CCI-000077	The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments.
CCI-001543	The organization disseminates the most recent information security program plan to appropriate entities in the organization that includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000021	The information system enforces dual authorization for organization-defined privileged commands and/or other organization-defined actions.
CCI-000022	The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.
CCI-000024	The information system prevents access to organization-defined security-relevant information except during secure, non-operable system states.
CCI-000213	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
CCI-000214	The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights.
CCI-000215	The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.
CCI-001408	The organization defines privileged commands for which dual authorization is to be enforced.
CCI-001409	The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access.
CCI-001410	The organization defines the set of users and resources over which the information system is to enforce nondiscretionary access control policies.
CCI-001411	The organization defines security-relevant information to which the information system prevents access except during secure, non-operable system states.
CCI-001412	The organization encrypts or stores off-line, in a secure location, organization-defined user information.
CCI-001413	The organization encrypts or stores off-line, in a secure location, organization-defined system information.
CCI-001362	The information system enforces a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.
CCI-001363	The organization establishes a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.
CCI-001366	The organization defines user information to be encrypted or stored off-line in a secure location.
CCI-001367	The organization defines system information to be encrypted or stored off-line in a secure location.
CCI-001693	The information system enforces a Discretionary Access Control (DAC) policy that limits propagation of access rights.
CCI-001694	The information system enforces a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.
CCI-000036	The organization separates organization-defined duties of individuals.
CCI-000037	The organization implements separation of duties through assigned information system access authorizations.
CCI-001380	The organization documents separation of duties of individuals.
CCI-000043	The organization defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.
CCI-000044	The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
CCI-000045	The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.
CCI-000046	The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.
CCI-000047	The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.
CCI-001423	The organization defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.
CCI-001452	The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.
CCI-001382	The organization defines the number of consecutive, unsuccessful login attempts to the mobile device.
CCI-001383	The information system provides additional protection for mobile devices accessed via login by purging information from the device after an organization-defined number of consecutive, unsuccessful login attempts to the mobile device.
CCI-000048	The information system displays an organization-defined system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-000049	The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to monitoring and recording.
CCI-000050	The information system retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system.
CCI-000051	The organization approves the information system use notification message before its use.
CCI-001384	The information system, for publicly accessible systems, displays system use information organization-defined conditions before granting further access.
CCI-001385	The information system, for publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.
CCI-001386	The information system, for publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.
CCI-001387	The information system, for publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.
CCI-001388	The information system, for publicly accessible systems, includes a description of the authorized uses of the system.
CCI-000052	The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).
CCI-000053	The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.
CCI-001389	The organization defines the time period that the information system notifies the user of the number of successful logon/access attempts.
CCI-001390	The organization defines the time period that the information system notifies the user of the number of unsuccessful logon/access attempts.
CCI-001391	The information system notifies the user of the number of successful logins/accesses that occur during the organization-defined time period.
CCI-001392	The information system notifies the user of the number of unsuccessful login/access attempts that occur during organization-defined time period.
CCI-001393	The organization defines the security-related characteristics/parameters of the user^s account which, when changed, will result in a notification being provided to the user during the organization-defined time period.
CCI-001394	The organization defines the time period during which organization-defined security-related changes to the user^s account are to be tracked.
CCI-001395	The information system notifies the user of changes to organization-defined security-related characteristics/parameters of the user^s account that occur during the organization-defined time period.
CCI-000054	The information system limits the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number of sessions.
CCI-000055	The organization defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.
CCI-000056	The information system retains the session lock until the user reestablishes access using established identification and authentication procedures.
CCI-000057	The information system initiates a session lock after the organization-defined time period of inactivity.
CCI-000058	The information system provides the capability for users to directly initiate session lock mechanisms.
CCI-000059	The organization defines the time period of inactivity after which the information system initiates a session lock.
CCI-000060	The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.
CCI-000061	The organization identifies and defines organization-defined user actions that can be performed on the information system without identification or authentication consistent with organizational missions/business functions.
CCI-000062	The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.
CCI-000232	The organization documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication.
CCI-000264	The organization develops a plan of action and milestones for the information system to document the organization^s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system.
CCI-000265	The organization defines the frequency with which to update the existing plan of action and milestones for the information system.
CCI-000266	The organization updates, on an organization-defined frequency, the existing plan of action and milestones for the information system based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.
CCI-000267	The organization employs automated mechanisms to help ensure the plan of action and milestones for the information system is accurate.
CCI-000268	The organization employs automated mechanisms to help ensure the plan of action and milestones for the information system is up to date.
CCI-000269	The organization employs automated mechanisms to help ensure the plan of action and milestones for the information system is readily available.
CCI-000270	The organization assigns a senior-level executive or manager as the authorizing official for the information system.
CCI-000271	The organization ensures the authorizing official authorizes the information system for processing before commencing operations.
CCI-000272	The organization updates the security authorization on an organization-defined frequency.
CCI-000273	The organization defines the frequency with which to update the security authorization.
CCI-000082	The organization establishes usage restrictions for organization-controlled mobile devices.
CCI-000083	The organization establishes implementation guidance for organization-controlled mobile devices.
CCI-000084	The organization authorizes connection of mobile devices to organizational information systems.
CCI-000085	The organization monitors for unauthorized connections of mobile devices to organizational information systems.
CCI-000086	The organization enforces requirements for the connection of mobile devices to organizational information systems.
CCI-000087	The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.
CCI-000088	The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
CCI-000089	The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
CCI-000090	The organization restricts the use of writable, removable media in organizational information systems.
CCI-000091	The organization prohibits the use of personally-owned, removable media in organizational information systems.
CCI-000092	The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.
CCI-001456	The organization defines locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
CCI-001457	The organization defines inspection and preventative measures to be applied on mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
CCI-001458	The organization requires that if classified information is found on mobile devices, the incident handling policy be followed.
CCI-001330	The organization prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.
CCI-001331	The organization prohibits connection of unclassified mobile devices to classified information systems.
CCI-001332	The organization requires approval from the authorizing official for the connection of unclassified mobile devices to unclassified information systems.
CCI-001333	The organization prohibits use of internal or external modems or wireless interfaces within unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information.
CCI-001334	The organization requires that unclassified mobile devices used in facilities containing information systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials.
CCI-001335	The organization defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information.
CCI-000093	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from the external information systems.
CCI-000094	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process organization-controlled information using the external information systems.
CCI-000095	The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-000096	The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization has approved information system connection or processing agreements with the organizational entity hosting the external information system.
CCI-000097	The organization restricts or prohibits the use of organization-controlled portable storage devices by authorized individuals on external information systems.
CCI-001465	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to store organization-controlled information using the external information systems.
CCI-001466	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to transmit organization-controlled information using the external information systems.
CCI-001467	The organization prohibits authorized individuals from using an external information system to process organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-001468	The organization prohibits authorized individuals from using an external information system to store organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-001469	The organization prohibits authorized individuals from using an external information system to transmit organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-000098	The organization facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for organization-defined information circumstances where user discretion is required.
CCI-000099	The information system enforces information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
CCI-001470	The organization defines information sharing circumstances where user discretion is required.
CCI-001471	The organization employs organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.
CCI-001472	The organization defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.
CCI-000106	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) as part of initial training for new users.
CCI-000107	The organization includes practical exercises in security awareness training that simulate actual cyber attacks.
CCI-000112	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) when required by information system changes.
CCI-001479	The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency.
CCI-001480	The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors).
CCI-000113	The organization documents individual information system security training activities, including basic security awareness training and specific information system security training.
CCI-000114	The organization monitors individual information system security training activities, including basic security awareness training and specific information system security training.
CCI-001336	The organization retains individual training records for an organization-defined time period.
CCI-001337	The organization defines a time period for retaining individual training records.
CCI-000115	The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.
CCI-000116	The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.
CCI-000130	The information system generates audit records containing information that establishes what type of event occurred.
CCI-000131	The information system generates audit records containing information that establishes when an event occurred.
CCI-000132	The information system generates audit records containing information that establishes where the event occurred.
CCI-000133	The information system generates audit records containing information that establishes the source of the event.
CCI-000134	The information system generates audit records containing information that establishes the outcome of the event.
CCI-000135	The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.
CCI-000136	The organization centrally manages the content of audit records generated by organization-defined information system components.
CCI-001487	The information system generates audit records containing information that establishes the identity of any individuals or subjects associated with the event.
CCI-001488	The organization defines additional, more detailed information to be included in the audit records.
CCI-001489	The organization defines information system components for which generated audit records are centrally managed by the organization.
CCI-000137	The organization allocates audit record storage capacity.
CCI-000138	The organization configures auditing to reduce the likelihood of storage capacity being exceeded.
CCI-000148	The organization reviews and analyzes information system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.
CCI-000149	The organization reports any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.
CCI-000150	The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.
CCI-000151	The organization defines the frequency for the review and analysis of information system audit records for organization-defined inappropriate or unusual activity.
CCI-000152	The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
CCI-000153	The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
CCI-000154	The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
CCI-000155	The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.
CCI-001344	The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.
CCI-001345	The organization employs automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications.
CCI-001346	The organization defines a list of inappropriate or unusual activities with security implications that are to result in alerts to security personnel.
CCI-001347	The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed.
CCI-001491	The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
CCI-000156	The information system provides an audit reduction capability.
CCI-000157	The information system provides a report generation capability.
CCI-000158	The information system provides the capability to process audit records for events of interest based on organization-defined audit fields within audit records.
CCI-000159	The information system uses internal system clocks to generate time stamps for audit records.
CCI-000160	The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.
CCI-000161	The organization defines the frequency for the synchronization of internal information system clocks.
CCI-001492	The organization defines an authoritative time source for the synchronization of internal information system clocks.
CCI-000166	The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
CCI-001338	The information system associates the identity of the information producer with the information.
CCI-001339	The information system validates the binding of the information producer's identity to the information.
CCI-001340	The information system maintains reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.
CCI-001341	The information system validates the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer between organization-defined security domains.
CCI-001342	The organization employs either FIPS-validated or NSA-approved cryptography to implement digital signatures.
CCI-001148	The organization employs FIPS-validated or NSA-approved cryptography to implement digital signatures.
CCI-000167	The organization retains audit records for an organization-defined time period to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
CCI-000168	The organization defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of security incidents and meet regulatory and organizational information retention requirements.
CCI-000206	The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
CCI-000209	The organization develops the results of information security measures of performance.
CCI-000210	The organization monitors the results of information security measures of performance.
CCI-000211	The organization reports on the results of information security measures of performance.
CCI-000212	The organization develops an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
CCI-000078	The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
CCI-000080	The organization ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement.
CCI-000081	The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.
CCI-000141	The organization ensures that information security resources are available for expenditure as planned.
CCI-000142	The organization implements a process for ensuring that plans of action and milestones for the security program and the associated organizational information systems are maintained.
CCI-000170	The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.
CCI-000207	The organization develops and maintains an inventory of its information systems.
CCI-000227	The organization develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.
CCI-000228	The organization implements a comprehensive strategy to manage risk to organization operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems consistently across the organization.
CCI-000229	The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
CCI-000230	The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
CCI-000231	The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes.
CCI-000233	The organization designates individuals to fulfill specific roles and responsibilities within the organizational risk management process.
CCI-000234	The organization fully integrates the security authorization processes into an organization-wide risk management program.
CCI-000235	The organization defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
CCI-000236	The organization determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until an achievable set of protection needs are obtained.
CCI-001460	The organization monitors organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized exfiltration or disclosure of organizational information.
CCI-001461	The organization defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.
CCI-000338	The organization defines physical access restrictions associated with changes to the information system.
CCI-000339	The organization documents physical access restrictions associated with changes to the information system.
CCI-000340	The organization approves physical access restrictions associated with changes to the information system.
CCI-000341	The organization enforces physical access restrictions associated with changes to the information system.
CCI-000342	The organization defines logical access restrictions associated with changes to the information system.
CCI-000343	The organization documents logical access restrictions associated with changes to the information system.
CCI-000344	The organization approves logical access restrictions associated with changes to the information system.
CCI-000345	The organization enforces logical access restrictions associated with changes to the information system.
CCI-000346	The organization employs automated mechanisms to enforce access restrictions.
CCI-000347	The organization employs automated mechanisms to support auditing of the enforcement actions.
CCI-000348	The organization defines a frequency with which to conduct reviews of information system changes.
CCI-000349	The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.
CCI-000350	The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.
CCI-000351	The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate.
CCI-000352	The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.
CCI-000353	The organization defines information system components requiring enforcement of a dual authorization for information system changes.
CCI-000354	The organization enforces dual authorization for changes to organization-defined information system components.
CCI-000355	The organization limits information system developer/integrator privileges to change hardware components directly within a production environment.
CCI-000356	The organization limits information system developer/integrator privileges to change software components directly within a production environment.
CCI-000357	The organization limits information system developer/integrator privileges to change firmware components directly within a production environment.
CCI-000358	The organization limits information system developer/integrator privileges to change system information directly within a production environment.
CCI-000359	The organization defines the frequency to review information system developer/integrator privileges.
CCI-000360	The organization defines the frequency to reevaluate information system developer/integrator privileges.
CCI-000361	The organization reviews information system developer/integrator privileges per organization-defined frequency.
CCI-000362	The organization reevaluates information system developer/integrator privileges per organization-defined frequency.
CCI-001499	The organization limits privileges to change software resident within software libraries.
CCI-001500	The information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.
CCI-001501	The organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately.
CCI-000389	The organization develops an inventory of information system components that accurately reflects the current information system.
CCI-000390	The organization documents an inventory of information system components that accurately reflects the current information system.
CCI-000391	The organization maintains an inventory of information system components that accurately reflects the current information system.
CCI-000392	The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system.
CCI-000393	The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system.
CCI-000394	The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system.
CCI-000395	The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
CCI-000396	The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
CCI-000397	The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.
CCI-000398	The organization defines information deemed necessary to achieve effective information system component accountability.
CCI-000399	The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.
CCI-000400	The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.
CCI-000401	The organization maintains an inventory of information system components that includes organization-defined information deemed necessary to achieve effective property accountability.
CCI-000402	The organization develops an inventory of information system components that is available for review by designated organizational officials.
CCI-000403	The organization documents an inventory of information system components that is available for review by designated organizational officials.
CCI-000404	The organization maintains an inventory of information system components that is available for review by designated organizational officials.
CCI-000405	The organization develops an inventory of information system components that is available for audit by designated organizational officials.
CCI-000406	The organization documents an inventory of information system components that is available for audit by designated organizational officials.
CCI-000407	The organization maintains an inventory of information system components that is available for audit by designated organizational officials.
CCI-000408	The organization updates the inventory of information system components as an integral part of component installations.
CCI-000409	The organization updates the inventory of information system components as an integral part of component removals.
CCI-000410	The organization updates the inventory of information system components as an integral part of information system updates.
CCI-000411	The organization employs automated mechanisms to help maintain an up-to-date inventory of information system components.
CCI-000412	The organization employs automated mechanisms to help maintain a complete inventory of information system components.
CCI-000413	The organization employs automated mechanisms to help maintain an accurate inventory of information system components.
CCI-000414	The organization employs automated mechanisms to help maintain a readily available inventory of information system components.
CCI-000415	The organization defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the information system.
CCI-000416	The organization employs automated mechanisms, per organization-defined frequency, to detect the presence of unauthorized hardware, software, and firmware components within the information system.
CCI-000417	The organization disables network access by unauthorized components/devices or notifies designated organizational officials.
CCI-000418	The organization includes, in the information system component inventory information, a means for identifying by name, position, and/or role, individuals responsible/accountable for administering those components.
CCI-000419	The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.
CCI-000420	The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.
CCI-000421	The organization develops a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.
CCI-000422	The organization documents a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.
CCI-000423	The organization implements a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.
CCI-000424	The organization develops a configuration management plan for the information system that defines the configuration items for the information system.
CCI-000425	The organization documents a configuration management plan for the information system that defines the configuration items for the information system.
CCI-000426	The organization implements a configuration management plan for the information system that defines the configuration items for the information system.
CCI-000427	The organization develops a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.
CCI-000428	The organization documents a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.
CCI-000429	The organization implements a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.
CCI-000430	The organization develops a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.
CCI-000431	The organization documents a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.
CCI-000432	The organization implements a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.
CCI-000433	The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
CCI-000434	The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
CCI-000435	The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
CCI-000436	The organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in information system development.
CCI-000485	The organization defines the frequency of refresher contingency training to information system users.
CCI-000486	The organization provides contingency training to information system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.
CCI-000487	The organization provides refresher contingency training to information system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.
CCI-000488	The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.
CCI-000489	The organization employs automated mechanisms to provide a more thorough and realistic contingency training environment.
CCI-000490	The organization defines the frequency with which to test the contingency plan for the information system.
CCI-000491	The organization defines the frequency to exercise the contingency plan for the information system.
CCI-000492	The organization defines contingency plan tests to be conducted for the information system.
CCI-000493	The organization defines contingency plan exercises to be conducted for the information system.
CCI-000494	The organization tests the contingency plan for the information system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.
CCI-000495	The organization exercises the contingency plan using organization-defined exercises in accordance with organization-defined frequency.
CCI-000496	The organization reviews the contingency plan test results.
CCI-000497	The organization initiates corrective actions, if needed, after reviewing the contingency plan test results.
CCI-000498	The organization coordinates contingency plan testing with organizational elements responsible for related plans.
CCI-000499	The organization coordinates contingency plan exercises with organizational elements responsible for related plans.
CCI-000500	The organization tests the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources.
CCI-000501	The organization exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site^s capabilities to support contingency operations.
CCI-000502	The organization employs automated mechanisms to more thoroughly and effectively test the contingency plan.
CCI-000503	The organization employs automated mechanisms to more thoroughly and effectively exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic exercise scenarios and environments, and more effectively stressing the information and supported missions.
CCI-000504	The organization includes a full recovery and reconstitution of the information system to a known state as part of contingency plan testing.
CCI-000968	The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.
CCI-000969	The organization ensures that the facility undergoes, on an organization-defined frequency, fire marshal inspections and promptly resolves identified deficiencies.
CCI-000970	The organization defines a frequency for fire marshal inspections.
CCI-000965	The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.
CCI-000966	The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire.
CCI-000967	The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders.
CCI-000971	The organization maintains temperature and humidity levels within the facility where the information system resides at organization-defined acceptable levels.
CCI-000972	The organization defines acceptable temperature and humidity levels to be maintained within the facility where the information system resides.
CCI-000973	The organization monitors temperature and humidity levels in accordance with organization-defined frequency.
CCI-000974	The organization defines a frequency for monitoring temperature and humidity levels.
CCI-000975	The organization employs automatic temperature and humidity controls in the facility to prevent fluctuations potentially harmful to the information system.
CCI-000976	The organization employs temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.
CCI-000977	The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible.
CCI-000978	The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly.
CCI-000979	Key personnel have knowledge of the master water shutoff or isolation valves.
CCI-000980	The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak.
CCI-001182	The information systems that collectively provide name/address resolution service for an organization are fault-tolerant.
CCI-001183	The information systems that collectively provide name/address resolution service for an organization implement internal/external role separation.
CCI-001173	The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
CCI-001174	The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
CCI-001175	The organization authorizes the use of VoIP within the information system.
CCI-001176	The organization monitors the use of VoIP within the information system.
CCI-001177	The organization controls the use of VoIP within the information system.
CCI-000550	The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.
CCI-000551	The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.
CCI-000552	The organization provides for the recovery and reconstitution of the information system to a known state after a failure.
CCI-000553	The information system implements transaction recovery for systems that are transaction-based.
CCI-000554	The organization defines in the security plan, explicitly or by reference, the circumstances that can inhibit recovery and reconstitution of the information system to a known state.
CCI-000555	The organization provides compensating security controls for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state.
CCI-000556	The organization defines restoration time periods within which to restore information system components from configuration-controlled and integrity-protected information representing a known, operational state for the components.
CCI-000557	The organization provides the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.
CCI-000558	The organization defines the real-time or near-real-time failover capability to be provided for the information system.
CCI-000559	The organization provides real-time or near-real-time organization-defined failover capability for the information system.
CCI-000560	The organization protects backup and restoration hardware.
CCI-000561	The organization protects backup and restoration firmware.
CCI-000562	The organization protects backup and restoration software.
CCI-000570	The organization develops a security plan for the information system that is consistent with the organization^s enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security category and impact level of the information system, including supporting rationale; describes the operational environment for the information system; describes relationships with, or connections to, other information systems; provides an overview of the security requirements for the system; and describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring and supplemental decisions.
CCI-000571	The organization^s security plan for the information system is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
CCI-000572	The organization defines the frequency for reviewing the security plan for the information system.
CCI-000573	The organization reviews the security plan for the information system in accordance with organization-defined frequency.
CCI-000574	The organization updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments.
CCI-000576	The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization.
CCI-000577	The organization defines the frequency with which to review and update the security CONOPS.
CCI-000578	The organization reviews and updates the security CONOPS in accordance with organization-defined frequency.
CCI-000580	The organization develops a functional architecture for the information system that identifies and maintains external interfaces.
CCI-000581	The organization develops a functional architecture for the information system that identifies and maintains the information being exchanged across the interfaces.
CCI-000582	The organization develops a functional architecture for the information system that identifies and maintains the protection mechanisms associated with each interface.
CCI-000583	The organization develops a functional architecture for the information system that identifies and maintains user roles.
CCI-000584	The organization develops a functional architecture for the information system that identifies and maintains the access privileges assigned to each role.
CCI-000585	The organization develops a functional architecture for the information system that identifies and maintains unique security requirements.
CCI-000586	The organization develops a functional architecture for the information system that identifies and maintains types of information processed by the information system.
CCI-000587	The organization develops a functional architecture for the information system that identifies and maintains types of information stored by the information system.
CCI-000588	The organization develops a functional architecture for the information system that identifies and maintains types of information transmitted by the information system.
CCI-000589	The organization develops a functional architecture for the information system that identifies and maintains any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-000590	The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information.
CCI-000591	The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information system services.
CCI-000597	The organization conducts a privacy impact assessment on the information system in accordance with OMB policy.
CCI-000598	The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation).
CCI-000599	The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational assets.
CCI-000600	The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational individuals.
CCI-001646	The organization defines the frequency with which to review and update the current system and services acquisition procedures.
CCI-000601	The organization defines the frequency with which to review and update the current system and services acquisition policy.
CCI-000602	The organization develops and documents a system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000603	The organization disseminates to organization-defined personnel or roles a system and services acquisition policy.
CCI-000604	The organization reviews and updates the current system and services acquisition policy in accordance with organization-defined frequency.
CCI-000605	The organization develops and documents procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.
CCI-000606	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.
CCI-000607	The organization reviews and updates the current system and services acquisition procedures in accordance with organization-defined frequency.
CCI-000615	The organization manages the information system using an organization-defined system development life cycle that incorporates information security considerations.
CCI-000616	The organization defines and documents information system security roles and responsibilities throughout the system development life cycle.
CCI-000617	The organization documents information system security roles and responsibilities throughout the system development life cycle.
CCI-000618	The organization identifies individuals having information system security roles and responsibilities.
CCI-000655	The organization uses software and associated documentation in accordance with contract agreements and copyright laws.
CCI-000656	The organization employs tracking systems for software and associated documentation protected by quantity licenses to control copying and distribution.
CCI-000657	The organization controls the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CCI-000658	The organization documents the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CCI-000659	The organization prohibits the use of binary executable code from sources with limited or no warranty without accompanying source code.
CCI-000660	The organization prohibits the use of machine executable code from sources with limited or no warranty without accompanying source code.
CCI-000661	The organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements.
CCI-000662	The organization obtains express written consent of the authorizing official for exceptions to the source code requirement.
CCI-000664	The organization applies information system security engineering principles in the specification of the information system.
CCI-000665	The organization applies information system security engineering principles in the design of the information system.
CCI-000666	The organization applies information system security engineering principles in the development of the information system.
CCI-000667	The organization applies information system security engineering principles in the implementation of the information system.
CCI-000668	The organization applies information system security engineering principles in the modification of the information system.
CCI-000669	The organization requires that providers of external information system services comply with organizational information security requirements.
CCI-000670	The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-000671	The organization defines government oversight with regard to external information system services.
CCI-000672	The organization documents government oversight with regard to external information system services.
CCI-000673	The organization defines user roles and responsibilities with regard to external information system services.
CCI-000674	The organization documents user roles and responsibilities with regard to external information system services.
CCI-000675	The organization monitors security control compliance by external service providers.
CCI-000676	The organization conducts an organizational assessment of risk prior to the acquisition of dedicated information security services.
CCI-000677	The organization conducts an organizational assessment of risk prior to the outsourcing of dedicated information security services.
CCI-000678	The organization defines the senior organizational official designated to approve acquisition of dedicated information security services.
CCI-000679	The organization defines the senior organizational official designated to approve outsourcing of dedicated information security services.
CCI-000680	The organization ensures the acquisition of dedicated information security services is approved by an organization-designated senior organizational official.
CCI-000681	The organization ensures the outsourcing of dedicated information security services is approved by an organization-designated senior organizational official.
CCI-000702	The organization requires information system developers, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.
CCI-000703	The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.
CCI-000704	The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.
CCI-000705	The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.
CCI-000706	The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.
CCI-000707	The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.
CCI-000708	The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.
CCI-000709	The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.
CCI-000710	The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.
CCI-000711	The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.
CCI-000712	The organization requires information system developers to employ code analysis tools to examine software for common flaws and document the results of the analysis.
CCI-000713	The organization requires information system integrators to employ code analysis tools to examine software for common flaws and document the results of the analysis.
CCI-000714	The organization requires information system developers to perform a vulnerability analysis to document vulnerabilities.
CCI-000715	The organization requires information system developers to perform a vulnerability analysis to document exploitation potential.
CCI-000716	The organization requires information system developers to perform a vulnerability analysis to document risk mitigations.
CCI-000717	The organization requires information system integrators to perform a vulnerability analysis to document vulnerabilities.
CCI-000718	The organization requires information system integrators to perform a vulnerability analysis to document exploitation potential.
CCI-000719	The organization requires information system integrators perform a vulnerability analysis to document risk mitigations.
CCI-000720	The organization requires information system developers implement the security test and evaluation plan under the witness of an independent verification and validation agent.
CCI-000721	The organization requires information system integrators to implement the security test and evaluation plan under the witness of an independent verification and validation agent.
CCI-000722	The organization defines the security safeguards to employ to protect against supply chain threats to the information system, system component, or information system service.
CCI-000723	The organization protects against supply chain threats to the information system, system component, or information system service by employing organization-defined security safeguards as part of a comprehensive, defense-in-breadth information security strategy.
CCI-000724	The organization purchases all anticipated information system components and spares in the initial acquisition.
CCI-000725	The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware.
CCI-000726	The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system software.
CCI-000727	The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system firmware.
CCI-000728	The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system services.
CCI-000729	The organization uses trusted shipping for information systems.
CCI-000730	The organization uses trusted shipping for information system components.
CCI-000731	The organization uses trusted shipping for information technology products.
CCI-000732	The organization uses trusted warehousing for information systems.
CCI-000733	The organization uses trusted warehousing for information system components.
CCI-000734	The organization uses trusted warehousing for information technology products.
CCI-000735	The organization employs a diverse set of suppliers for information systems.
CCI-000736	The organization employs a diverse set of suppliers for information system components.
CCI-000737	The organization employs a diverse set of suppliers for information technology products.
CCI-000738	The organization employs a diverse set of suppliers for information system services.
CCI-000739	The organization employs standard configurations for information systems.
CCI-000740	The organization employs standard configurations for information system components.
CCI-000741	The organization employs standard configurations for information technology products.
CCI-000742	The organization minimizes the time between purchase decisions and delivery of information systems.
CCI-000743	The organization minimizes the time between purchase decisions and delivery of information system components.
CCI-000744	The organization minimizes the time between purchase decisions and delivery of information technology products.
CCI-000745	The organization employs independent analysis and penetration testing against delivered information systems.
CCI-000746	The organization employs independent analysis and penetration testing against delivered information system components.
CCI-000747	The organization employs independent analysis and penetration testing against delivered information technology products.
CCI-000748	The organization defines level of trustworthiness for the information system.
CCI-000749	The organization requires that the information system meets the organization-defined level of trustworthiness.
CCI-000750	The organization defines the list of critical information system components that require re-implementation.
CCI-000751	The organization determines the organization-defined list of critical information system components that require re-implementation.
CCI-000752	The organization re-implements organization-defined critical information system components.
CCI-000753	The organization identifies information system components for which alternative sourcing is not viable.
CCI-000754	The organization defines measures to be employed to prevent critical security controls for information system components from being compromised.
CCI-000755	The organization employs organization-defined measures to ensure critical security controls for the information system components are not compromised.
CCI-000756	The organization develops an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000757	The organization disseminates to organization-defined personnel or roles an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000758	The organization reviews and updates identification and authentication policy in accordance with the organization-defined frequency.
CCI-000759	The organization defines a frequency for reviewing and updating the identification and authentication policy.
CCI-000760	The organization develops procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
CCI-000761	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
CCI-000762	The organization reviews and updates identification and authentication procedures in accordance with the organization-defined frequency.
CCI-000763	The organization defines a frequency for reviewing and updating the identification and authentication procedures.
CCI-000764	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
CCI-000765	The information system implements multifactor authentication for network access to privileged accounts.
CCI-000766	The information system implements multifactor authentication for network access to non-privileged accounts.
CCI-000767	The information system implements multifactor authentication for local access to privileged accounts.
CCI-000768	The information system implements multifactor authentication for local access to non-privileged accounts.
CCI-000769	The organization allows the use of group authenticators only when used in conjunction with an individual/unique authenticator.
CCI-000770	The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.
CCI-000771	The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed.
CCI-000772	The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed.
CCI-000773	The organization defines replay-resistant authentication mechanisms to be used for network access to privileged accounts.
CCI-000774	The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.
CCI-000775	The organization defines replay-resistant authentication mechanisms to be used for network access to non-privileged accounts.
CCI-000776	The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.
CCI-000777	The organization defines a list of specific and/or types of devices for which identification and authentication is required before establishing a connection to the information system.
CCI-000778	The information system uniquely identifies an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.
CCI-000779	The information system authenticates devices before establishing remote network connections using bidirectional authentication between devices that is cryptographically based.
CCI-000780	The information system authenticates devices before establishing wireless network connections using bidirectional authentication between devices that is cryptographically based.
CCI-000781	The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.
CCI-000782	The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.
CCI-000783	The organization audits lease information when assigned to a device.
CCI-000784	The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.
CCI-000785	The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier.
CCI-000786	The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual.
CCI-000787	The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device.
CCI-000788	The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party.
CCI-000789	The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device.
CCI-000790	The organization defines a time period for which the reuse of user identifiers is prohibited.
CCI-000791	The organization defines a time period for which the reuse of device identifiers is prohibited.
CCI-000792	The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period.
CCI-000793	The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period.
CCI-000794	The organization defines a time period of inactivity after which the identifier is disabled.
CCI-000795	The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.
CCI-000796	The organization prohibits the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.
CCI-000797	The organization requires that registration to receive a user ID and password include authorization by a supervisor.
CCI-000798	The organization requires that registration to receive a user ID and password be done in person before a designated registration authority.
CCI-000799	The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority.
CCI-000800	The organization defines characteristics for identifying individual status.
CCI-000801	The organization manages individual identifiers by uniquely identifying each individual by organization-defined characteristics identifying individual status.
CCI-000802	The information system dynamically manages identifiers, attributes, and associated access authorizations.
CCI-000803	The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
CCI-000804	The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
CCI-000805	The organization develops and documents an incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000806	The organization disseminates an incident response policy to organization-defined personnel or roles.
CCI-000807	The organization reviews and updates the current incident response policy in accordance with organization-defined frequency.
CCI-000808	The organization defines the frequency with which to review and update the current incident response policy.
CCI-000809	The organization develops and documents procedures to facilitate the implementation of the incident response policy and associated incident response controls.
CCI-000810	The organization disseminates incident response procedures to organization-defined personnel or roles.
CCI-000811	The organization reviews and updates the current incident response procedures in accordance with organization-defined frequency.
CCI-000812	The organization defines the frequency with which to review and update the current incident response procedures.
CCI-000834	The organization defines a time period for personnel to report suspected security incidents to the organizational incident response capability.
CCI-000835	The organization requires personnel to report suspected security incidents to the organizational incident response capability within the organization-defined time period.
CCI-000836	The organization reports security incident information to organization-defined authorities.
CCI-000837	The organization employs automated mechanisms to assist in the reporting of security incidents.
CCI-000838	The organization reports information system vulnerabilities associated with reported security incidents to organization-defined personnel or roles.
CCI-000839	The organization provides an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the information system for the handling and reporting of security incidents.
CCI-000840	The organization employs automated mechanisms to increase the availability of incident response-related information and support.
CCI-000841	The organization establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability.
CCI-000842	The organization identifies organizational incident response team members to the external providers.
CCI-000843	The organization develops an incident response plan that provides the organization with a roadmap for implementing its incident response capability; describes the structure and organization of the incident response capability; provides a high-level approach for how the incident response capability fits into the overall organization; meets the unique requirements of the organization, which relate to mission, size, structure, and functions; defines reportable incidents; provides metrics for measuring the incident response capability within the organization; and defines the resources and management support needed to effectively maintain and mature an incident response capability.
CCI-000844	The organization develops an incident response plan that is reviewed and approved by organization-defined personnel or roles.
CCI-000845	The organization defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.
CCI-000846	The organization distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.
CCI-000847	The organization defines the frequency for reviewing the incident response plan.
CCI-000848	The organization reviews the incident response plan on an organization-defined frequency.
CCI-000849	The organization updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.
CCI-000850	The organization communicates incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.
CCI-000865	The organization approves information system maintenance tools.
CCI-000866	The organization controls information system maintenance tools.
CCI-000867	The organization monitors information system maintenance tools.
CCI-000868	The organization maintains, on an ongoing basis, information system maintenance tools.
CCI-000869	The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.
CCI-000870	The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.
CCI-000871	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.
CCI-000872	The organization employs automated mechanisms to restrict the use of maintenance tools to authorized personnel only.
CCI-000890	The organization establishes a process for maintenance personnel authorization.
CCI-000891	The organization maintains a list of authorized maintenance organizations or personnel.
CCI-000892	The organization ensures that personnel performing maintenance on the information system have required access authorizations or designates organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance.
CCI-000893	The organization implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens.
CCI-000894	The organization requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.
CCI-000895	The organization requires that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured.
CCI-000896	The organization requires that in the event an information system component cannot be sanitized, the procedures contained in the security plan for the system be enforced.
CCI-000897	The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.
CCI-000898	The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information are U.S. citizens.
CCI-000899	The organization ensures that cleared foreign nationals (i.e., foreign nationals with appropriate security clearances) are used to conduct maintenance and diagnostic activities on classified information systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.
CCI-000900	The organization ensures that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified information systems are fully documented within Memoranda of Agreements.
CCI-000901	The organization defines a list of security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts.
CCI-000902	The organization defines a time period for obtaining maintenance support and/or spare parts for security-critical information system components and/or key information technology components.
CCI-000903	The organization obtains maintenance support and/or spare parts for organization-defined information system components within an organization-defined time period of failure.
CCI-000904	The organization develops and documents a physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000905	The organization disseminates a physical and environmental protection policy to organization-defined personnel or roles.
CCI-000906	The organization reviews and updates the current physical and environmental protection policy in accordance with organization-defined frequency.
CCI-000907	The organization defines the frequency with which to review and update the physical and environmental protection policy.
CCI-000908	The organization develops and documents procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.
CCI-000909	The organization disseminates physical and environmental protection procedures to organization-defined personnel or roles.
CCI-000910	The organization reviews and updates the current physical and environmental protection procedures in accordance with organization-defined frequency.
CCI-000911	The organization defines the frequency with which to review and update the physical and environmental protection procedures.
CCI-000919	The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides.
CCI-000920	The organization verifies individual access authorizations before granting access to the facility.
CCI-000921	The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.
CCI-000922	The organization controls access to areas officially designated as publicly accessible in accordance with the organization^s assessment of risk.
CCI-000923	The organization secures keys, combinations, and other physical access devices.
CCI-000924	The organization inventories organization-defined physical access devices on an organization-defined frequency.
CCI-000925	The organization defines the frequency for conducting inventories of organization-defined physical access devices.
CCI-000926	The organization changes combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
CCI-000927	The organization defines a frequency for changing combinations and keys.
CCI-000928	The organization enforces physical access authorizations to the information system in addition to the physical access controls for the facility where the information system resides at organization-defined physical spaces containing one or more components of the information system.
CCI-000929	The organization performs security checks in accordance with organization-defined frequency at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of information system components.
CCI-000930	The organization employs guards and/or alarms to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.
CCI-000931	The organization uses lockable physical casings to protect organization-defined information system components from unauthorized physical access.
CCI-000932	The organization defines information system components to be protected from unauthorized physical access using lockable physical casings.
CCI-000933	The organization employs organization-defined security safeguards to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the information system.
CCI-000934	The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency.
CCI-000935	The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility.
CCI-000936	The organization controls physical access to organization-defined information system distribution and transmission lines within organizational facilities using organization-defined security safeguards.
CCI-000937	The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.
CCI-000938	The organization monitors physical access to the information system to detect and respond to physical security incidents.
CCI-000939	The organization reviews physical access logs in accordance with organization-defined frequency.
CCI-000940	The organization defines a frequency for reviewing physical access logs.
CCI-000941	The organization coordinates results of reviews and investigations with the organization^s incident response capability.
CCI-000942	The organization monitors physical intrusion alarms and surveillance equipment.
CCI-000943	The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions.
CCI-000944	The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.
CCI-000945	The organization escorts visitors and monitors visitor activity, when required.
CCI-000946	The organization requires two forms of identification for visitor access to the facility.
CCI-000947	The organization maintains visitor access records to the facility where the information system resides for an organization-defined time period.
CCI-000948	The organization reviews visitor access records in accordance with organization-defined frequency.
CCI-000949	The organization defines the frequency with which to review the visitor access records for the facility where the information system resides.
CCI-000950	The organization employs automated mechanisms to facilitate the maintenance and review of access records.
CCI-000951	The organization maintains a record of all physical access, both visitor and authorized individuals.
CCI-000952	The organization protects power equipment and power cabling for the information system from damage and destruction.
CCI-000953	The organization employs redundant and parallel power cabling paths.
CCI-000954	The organization employs automatic voltage controls for organization-defined critical information system components.
CCI-000955	The organization defines critical information system components that require automatic voltage controls.
CCI-000956	The organization provides the capability of shutting off power to the information system or individual system components in emergency situations.
CCI-000957	The organization places emergency shutoff switches or devices in an organization-defined location by information system or system component to facilitate safe and easy access for personnel.
CCI-000958	The organization defines a location for emergency shutoff switches or devices by information system or system component.
CCI-000959	The organization protects emergency power shutoff capability from unauthorized activation.
CCI-000960	The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss.
CCI-000961	The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability in the event of an extended loss of the primary power source.
CCI-000962	The organization provides a long-term alternate power supply for the information system that is self-contained and not reliant on external power generation.
CCI-000963	The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
CCI-000964	The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.
CCI-000981	The organization authorizes organization-defined types of information system components entering and exiting the facility.
CCI-000982	The organization monitors organization-defined types of information system components entering and exiting the facility.
CCI-000983	The organization controls organization-defined types of information system components entering and exiting the facility.
CCI-000984	The organization maintains records of information system components entering and exiting the facility.
CCI-000985	The organization employs organization-defined security controls at alternate work sites.
CCI-000986	The organization defines management, operational, and technical information system security controls to be employed at alternate work sites.
CCI-000987	The organization assesses as feasible, the effectiveness of security controls at alternate work sites.
CCI-000988	The organization provides a means for employees to communicate with information security personnel in case of security incidents or problems.
CCI-000989	The organization positions information system components within the facility to minimize potential damage from organization-defined physical and environmental hazards.
CCI-000990	The organization positions information system components within the facility to minimize potential damage from environmental hazards.
CCI-000991	The organization positions information system components within the facility to minimize the opportunity for unauthorized access.
CCI-000992	The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards, and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy.
CCI-000993	The organization protects the information system from information leakage due to electromagnetic signals emanations.
CCI-000994	The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.
CCI-000995	The organization develops and documents a media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-000996	The organization disseminates to organization-defined personnel or roles a media protection policy.
CCI-000997	The organization reviews and updates the current media protection policy in accordance with organization-defined frequency.
CCI-000998	The organization defines a frequency for reviewing and updating the current media protection policy.
CCI-000999	The organization develops and documents procedures to facilitate the implementation of the media protection policy and associated media protection controls.
CCI-001000	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls.
CCI-001001	The organization reviews and updates the current media protection procedures in accordance with organization-defined frequency.
CCI-001002	The organization defines a frequency for reviewing and updating the current media protection procedures.
CCI-001003	The organization restricts access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.
CCI-001004	The organization defines types of digital and/or non-digital media for which the organization restricts access.
CCI-001005	The organization defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.
CCI-001006	The organization defines security measures for restricting access to media.
CCI-001007	The organization employs automated mechanisms to restrict access to media storage areas.
CCI-001008	The organization employs automated mechanisms to audit access attempts and access granted to media storage areas.
CCI-001009	The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media.
CCI-001014	The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas.
CCI-001015	The organization defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.
CCI-001016	The organization defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.
CCI-001017	The organization defines security measures for securing media storage.
CCI-001018	The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
CCI-001019	The organization employs cryptographic mechanisms to protect information in storage.
CCI-001020	The organization protects and controls organization-defined types of information system media during transport outside of controlled areas using organization-defined security safeguards.
CCI-001021	The organization defines types of information system media protected and controlled during transport outside of controlled areas.
CCI-001022	The organization defines security safeguards to be used to protect and control organization-defined types of information system media during transport outside of controlled areas.
CCI-001023	The organization maintains accountability for information system media during transport outside of controlled areas.
CCI-001024	The organization restricts the activities associated with the transport of information system media to authorized personnel.
CCI-001025	The organization documents activities associated with the transport of information system media.
CCI-001026	The organization employs an identified custodian during transport of information system media outside of controlled areas.
CCI-001027	The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
CCI-001028	The organization sanitizes organization-defined information system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures in accordance with applicable federal and organizational standards and policies.
CCI-001029	The organization tracks, documents, and verifies media sanitization and disposal actions.
CCI-001030	The organization tests sanitization equipment and procedures in accordance with the organization-defined frequency to verify that the intended sanitization is being achieved.
CCI-001031	The organization defines a frequency for testing sanitization equipment and procedures to verify that the intended sanitization is being achieved.
CCI-001032	The organization applies nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the information system in accordance with organization-defined circumstances requiring sanitization of portable storage devices.
CCI-001033	The organization defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the information system.
CCI-001034	The organization sanitizes information system media containing Controlled Unclassified Information (CUI) or other sensitive information in accordance with applicable organizational and/or federal standards and policies.
CCI-001035	The organization sanitizes information system media containing classified information in accordance with NSA standards and policies.
CCI-001036	The organization destroys information system media that cannot be sanitized.
CCI-001037	The organization develops and documents a risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001038	The organization disseminates a risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.
CCI-001039	The organization reviews and updates the current risk assessment policy in accordance with organization-defined frequency.
CCI-001040	The organization defines the frequency with which to review and update the current risk assessment policy.
CCI-001041	The organization develops and documents procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls.
CCI-001042	The organization disseminates risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles.
CCI-001043	The organization reviews and updates the current risk assessment procedures in accordance with organization-defined frequency.
CCI-001044	The organization defines the frequency with which to review and update the current risk assessment procedures.
CCI-001045	The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-001046	The organization documents the security categorization results (including supporting rationale) in the security plan for the information system.
CCI-001047	The organization ensures the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.
CCI-001074	The organization develops a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001075	The organization disseminates to organization-defined personnel or roles the system and communications protection policy.
CCI-001076	The organization reviews and updates the system and communications protection policy in accordance with organization-defined frequency.
CCI-001077	The organization defines the frequency for reviewing and updating the system and communications protection policy.
CCI-001078	The organization develops system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
CCI-001079	The organization disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
CCI-001080	The organization reviews and updates the system and communications protection procedures in accordance with organization-defined frequency.
CCI-001081	The organization defines the frequency of system and communications protection procedure reviews and updates.
CCI-001082	The information system separates user functionality (including user interface services) from information system management functionality.
CCI-001083	The information system prevents the presentation of information system management-related functionality at an interface for non-privileged users.
CCI-001090	The information system prevents unauthorized and unintended information transfer via shared system resources.
CCI-001091	The information system does not share resources that are used to interface with systems operating at different security levels.
CCI-001092	The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks.
CCI-001093	The organization defines the types of denial of service attacks (or provides references to sources of current denial of service attacks) that can be addressed by the information system.
CCI-001094	The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.
CCI-001095	The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.
CCI-001096	The information system limits the use of resources by priority.
CCI-001127	The information system protects the integrity of transmitted information.
CCI-001128	The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.
CCI-001129	The information system maintains the integrity of information during aggregation, packaging, and transformation in preparation for transmission.
CCI-001130	The information system protects the confidentiality of transmitted information.
CCI-001131	The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.
CCI-001132	The information system maintains the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission.
CCI-001133	The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
CCI-001134	The organization defines the time period of inactivity after which the information system terminates a network connection associated with a communications session.
CCI-001137	The organization establishes cryptographic keys for required cryptography employed within the information system.
CCI-001138	The organization manages cryptographic keys for required cryptography employed within the information system.
CCI-001139	The organization maintains availability of information in the event of the loss of cryptographic keys by users.
CCI-001140	The organization produces, controls, and distributes symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes.
CCI-001141	The organization produces, controls, and distributes symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes.
CCI-001142	The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material.
CCI-001143	The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key.
CCI-001144	The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-001145	The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information.
CCI-001146	The organization employs NSA-approved cryptography to protect classified information.
CCI-001147	The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.
CCI-001149	The information system protects the integrity and availability of publicly available information and applications.
CCI-001150	The information system prohibits remote activation of collaborative computing devices, excluding the organization-defined exceptions where remote activation is to be allowed.
CCI-001151	The organization defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed.
CCI-001152	The information system provides an explicit indication of use to users physically present at collaborative computing devices.
CCI-001153	The information system provides physical disconnect of collaborative computing devices in a manner that supports ease of use.
CCI-001154	The information system or supporting environment blocks both inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers.
CCI-001155	The organization disables or removes collaborative computing devices from organization-defined information systems or information system components in organization-defined secure work areas.
CCI-001156	The organization defines secure work areas where collaborative computing devices are to be disabled or removed.
CCI-001157	The information system associates organization-defined security attributes with information exchanged between information systems.
CCI-001158	The information system validates the integrity of transmitted security attributes.
CCI-001159	The organization issues public key certificates under an organization-defined certificate policy or obtains public key certificates from an approved service provider.
CCI-001180	The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems.
CCI-001181	The information system performs data origin authentication and data integrity verification on all resolution responses received whether or not local client systems explicitly request this service.
CCI-001194	The information system employs organization-defined information system components with minimal functionality and information storage.
CCI-001195	The information system includes components specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting, and analyzing such attacks.
CCI-001196	The information system includes components that proactively seek to identify malicious websites and/or web-based malicious code.
CCI-001197	The information system includes organization-defined platform-independent applications.
CCI-001198	The organization defines applications that are platform independent.
CCI-001201	The organization employs a diverse set of information technologies for organization-defined information system components in the implementation of the information system.
CCI-001202	The organization employs virtualization techniques to present information system components as other types of components, or components with differing configurations.
CCI-001203	The organization employs virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency.
CCI-001204	The organization defines the frequency of changes to operating systems and applications to support a diversity of deployments.
CCI-001205	The organization employs randomness in the implementation of the virtualization techniques.
CCI-001206	The organization requires that information system developers/integrators perform a covert channel analysis to identify those aspects of system communication that are potential avenues for covert storage and timing channels.
CCI-001207	The organization tests a subset of the identified covert channels to determine which channels are exploitable.
CCI-001208	The organization partitions the information system into components residing in separate physical domains (or environments) as deemed necessary.
CCI-001209	The information system protects the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission.
CCI-001210	The information system, at organization-defined information system components, loads and executes the operating environment from hardware-enforced, read-only media.
CCI-001211	The information system, at organization-defined information system components, loads and executes organization-defined applications from hardware-enforced, read-only media.
CCI-001212	The organization defines information system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.
CCI-001213	The organization defines applications that will be loaded and executed from hardware-enforced, read-only media.
CCI-001214	The organization employs organization-defined information system components with no writeable storage that are persistent across component restart or power on/off.
CCI-001215	The organization defines the information system components to be employed with no writeable storage.
CCI-001216	The organization protects the integrity of information prior to storage on read-only media.
CCI-001217	The organization develops and documents a system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001218	The organization disseminates the system and information integrity policy to organization-defined personnel or roles.
CCI-001219	The organization reviews and updates system and information integrity policy in accordance with organization-defined frequency.
CCI-001220	The organization develops and documents procedures to facilitate the implementation of the system and information integrity policy and associated system integrity controls.
CCI-001221	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system integrity controls.
CCI-001222	The organization reviews and updates system and information integrity procedures in accordance with organization-defined frequency.
CCI-001223	The organization defines the frequency of system and information integrity policy reviews and updates.
CCI-001224	The organization defines the frequency of system and information integrity procedure reviews and updates.
CCI-001285	The organization receives information system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis.
CCI-001286	The organization generates internal security alerts, advisories, and directives as deemed necessary.
CCI-001287	The organization disseminates security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations.
CCI-001288	The organization defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives.
CCI-001289	The organization implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.
CCI-001290	The organization employs automated mechanisms to make security alert and advisory information available throughout the organization.
CCI-001297	The information system detects unauthorized changes to software and information.
CCI-001298	The organization reassesses the integrity of software and information by performing, on an organization-defined frequency, integrity scans of the information system.
CCI-001299	The organization defines the frequency of integrity scans to be performed on the information system.
CCI-001300	The organization employs automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification.
CCI-001301	The organization employs centrally managed integrity verification tools.
CCI-001302	The organization requires use of tamper-evident packaging for organization-defined information system components during organization-defined conditions.
CCI-001303	The organization defines information system components that require tamper-evident packaging.
CCI-001304	The organization defines conditions (i.e., transportation from vendor to operational site, during operation, both) under which tamper-evident packaging must be used for organization-defined information system components.
CCI-001309	The organization restricts the capability to input information to the information system to authorized personnel.
CCI-001310	The information system checks the validity of organization-defined inputs.
CCI-001311	The information system identifies potentially security-relevant error conditions.
CCI-001312	The information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
CCI-001313	The organization defines sensitive or potentially harmful information that should not be contained in error logs and administrative messages.
CCI-001314	The information system reveals error messages only to organization-defined personnel or roles.
CCI-001462	The information system provides the capability for authorized users to capture/record and log content related to a user session.
CCI-001463	The information system provides the capability to remotely view/hear all content related to an established user session in real time.
CCI-001464	The information system initiates session audits at system start-up.
CCI-001473	The organization designates individuals authorized to post information onto a publicly accessible information system.
CCI-001474	The organization trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information.
CCI-001475	The organization reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included.
CCI-001476	The organization reviews the content on the publicly accessible information system for nonpublic information on an organization-defined frequency.
CCI-001477	The organization defines a frequency for reviewing the content on the publicly accessible information system for nonpublic information.
CCI-001478	The organization removes nonpublic information from the publicly accessible information system, if discovered.
CCI-001504	The organization develops and documents a personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001505	The organization disseminates a personnel security policy to organization-defined personnel or roles.
CCI-001506	The organization reviews and updates the current personnel security policy in accordance with organization-defined frequency.
CCI-001507	The organization defines the frequency with which to review and update the current personnel security policy.
CCI-001508	The organization defines the frequency with which to review and update the current personnel security procedures.
CCI-001509	The organization develops and documents procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.
CCI-001510	The organization disseminates personnel security procedures to organization-defined personnel or roles.
CCI-001511	The organization reviews and updates the current personnel security procedures in accordance with organization-defined frequency.
CCI-001512	The organization assigns a risk designation to all organizational positions.
CCI-001513	The organization establishes screening criteria for individuals filling organizational positions.
CCI-001514	The organization reviews and updates position risk designations in accordance with organization-defined frequency.
CCI-001515	The organization defines the frequency with which to review and update position risk designations.
CCI-001516	The organization screens individuals prior to authorizing access to the information system.
CCI-001517	The organization rescreens individuals with authorized access to the information system according to organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of such rescreening.
CCI-001518	The organization defines the conditions requiring rescreening of individuals with authorized access to the information system.
CCI-001519	The organization defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met.
CCI-001520	The organization ensures that individuals accessing an information system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.
CCI-001521	The organization ensures that individuals accessing an information system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.
CCI-001522	The organization, upon termination of individual employment, disables information system access within an organization-defined time period.
CCI-001523	The organization, upon termination of individual employment, conducts exit interviews that include a discussion of organization-defined information security topics.
CCI-001524	The organization, upon termination of individual employment, retrieves all security-related organizational information system-related property.
CCI-001525	The organization, upon termination of individual employment, retains access to organizational information formerly controlled by the terminated individual.
CCI-001526	The organization, upon termination of individual employment, retains access to organizational information systems formerly controlled by the terminated individual.
CCI-001527	The organization reviews and confirms the ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization.
CCI-001528	The organization initiates organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.
CCI-001529	The organization defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.
CCI-001530	The organization defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.
CCI-001531	The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.
CCI-001532	The organization reviews and updates access agreements for organizational information systems in accordance with organization-defined frequency.
CCI-001533	The organization defines the frequency with which to review and update access agreements for organizational information systems.
CCI-001534	The organization ensures that access to information with special protection measures is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.
CCI-001535	The organization ensures that access to information with special protection measures is granted only to individuals who satisfy associated personnel security criteria.
CCI-001536	The organization ensures that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.
CCI-001537	The organization ensures that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.
CCI-001538	The organization ensures that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement.
CCI-001539	The organization establishes personnel security requirements including security roles and responsibilities for third-party providers.
CCI-001540	The organization documents personnel security requirements for third-party providers.
CCI-001541	The organization monitors third-party provider compliance with personnel security requirements.
CCI-001542	The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures.
CCI-002106	The organization documents the access control policy.
CCI-002107	The organization defines the personnel or roles to be recipients of the access control policy necessary to facilitate the implementation of the access control policy and associated access controls.
CCI-002108	The organization defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the access control policy and associated access controls.
CCI-002109	The organization documents procedures to facilitate the implementation of the access control policy and associated access controls.
CCI-002110	The organization defines the information system account types that support the organizational missions/business functions.
CCI-002111	The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions.
CCI-002112	The organization assigns account managers for information system accounts.
CCI-002113	The organization establishes conditions for role membership.
CCI-002114	The organization specifies authorized users of the information system for each account.
CCI-002115	The organization specifies authorized users of the information system.
CCI-002116	The organization specifies authorized group membership on the information system.
CCI-002117	The organization specifies authorized role membership on the information system.
CCI-002118	The organization specifies access authorizations (i.e., privileges) for each account on the information system.
CCI-002119	The organization specifies other attributes for each account on the information system.
CCI-002120	The organization defines the personnel or roles authorized to approve the creation of information system accounts.
CCI-002121	The organization defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
CCI-002122	The organization monitors the use of information system accounts.
CCI-002123	The organization notifies account managers when accounts are no longer required.
CCI-002124	The organization notifies account managers when users are terminated or transferred.
CCI-002125	The organization notifies account managers when individual information system usage or need-to-know changes.
CCI-002126	The organization authorizes access to the information system based on a valid access authorization.
CCI-002127	The organization authorizes access to the information system based on intended system usage.
CCI-002128	The organization authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions.
CCI-002129	The organization establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
CCI-002130	The information system automatically audits account enabling actions.
CCI-002131	The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions.
CCI-002132	The information system notifies organization-defined personnel or roles for account enabling actions.
CCI-002133	The organization defines other conditions when users are required to log out.
CCI-002134	The organization defines a list of dynamic privilege management capabilities to be implemented by the information system.
CCI-002135	The information system implements the organization-defined list of dynamic privilege management capabilities.
CCI-002136	The organization defines the actions to be taken when privileged role assignments are no longer appropriate.
CCI-002137	The organization takes organization-defined actions when privileged role assignments are no longer appropriate.
CCI-002138	The organization defines the information system accounts that can be dynamically created.
CCI-002139	The information system creates organization-defined information system accounts dynamically.
CCI-002140	The organization defines the conditions for establishing shared/group accounts.
CCI-002141	The organization only permits the use of shared/group accounts that meet organization-defined conditions for establishing shared/group accounts.
CCI-002142	The information system terminates shared/group account credentials when members leave the group.
CCI-002143	The organization defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.
CCI-002144	The organization defines the information system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.
CCI-002145	The information system enforces organization-defined circumstances and/or usage conditions for organization-defined information system accounts.
CCI-002146	The organization defines atypical usage for which the information system accounts are to be monitored.
CCI-002147	The organization monitors information system accounts for organization-defined atypical use.
CCI-002148	The organization defines the personnel or roles to whom atypical usage of information system accounts are to be reported.
CCI-002149	The organization reports atypical usage of information system accounts to organization-defined personnel or roles.
CCI-002150	The organization defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.
CCI-002151	The organization disables accounts of users posing a significant risk within an organization-defined time period of discovery of the risk.
CCI-002152	The organization defines other actions necessary for which dual authorization is to be enforced.
CCI-002153	The organization defines the mandatory access control policies that are to be enforced over all subjects and objects.
CCI-002154	The mandatory access control policy specifies that the policy is uniformly enforced across all subjects and objects within the boundary of the information system.
CCI-002155	The mandatory access control policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.
CCI-002156	The mandatory access control policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.
CCI-002157	The mandatory access control policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the information system, or information system components.
CCI-002158	The mandatory access control policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.
CCI-002159	The mandatory access control policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.
CCI-002160	The mandatory access control policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.
CCI-002161	The organization defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by some or all of the mandatory access control constraints.
CCI-002162	The organization defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by some or all of the mandatory access control constraints.
CCI-002163	The organization defines the discretionary access control policies the information system is to enforce over subjects and objects.
CCI-002164	The organization specifies in the discretionary access control policies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the information system, or the information system^s components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.
CCI-002165	The information system enforces organization-defined discretionary access control policies over defined subjects and objects.
CCI-002166	The organization defines the role-based access control policies the information system is to enforce over all subjects and objects.
CCI-002167	The organization defines the subjects over which the information system will enforce a role-based access control policy.
CCI-002168	The organization defines the objects over which the information system will enforce a role-based access control policy.
CCI-002169	The information system enforces a role-based access control policy over defined subjects and objects.
CCI-002170	The information system controls access based upon organization-defined roles and users authorized to assume such roles.
CCI-002171	The information system enforces a role-based access control policy over organization-defined subjects.
CCI-002172	The information system enforces a role-based access control policy over organization-defined objects.
CCI-002173	The organization defines the roles for which the information system will control access based upon the organization-defined role-based access control policy.
CCI-002174	The organization defines the users for which the information system will control access based upon the organization-defined role-based access control policy.
CCI-002175	The information system controls access based upon organization-defined roles authorized to assume such roles, employing the organization-defined role-based access control policy.
CCI-002176	The information system controls access based upon organization-defined users authorized to assume such roles, employing the organization-defined role-based access control policy.
CCI-002177	The organization defines the rules which will govern the timing of revocation of access authorizations.
CCI-002178	The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.
CCI-002179	The information system enforces the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.
CCI-002180	The organization defines the security safeguards the organization-defined information system or system component is to provide to protect information released outside the established system boundary.
CCI-002181	The organization defines information systems or system components that are to provide organization-defined security safeguards to protect information received outside the established system boundary.
CCI-002182	The information system does not release information outside of the established system boundary unless the receiving organization-defined information system or system component provides organization-defined security safeguards.
CCI-002183	The organization defines the security safeguards to be used to validate the appropriateness of the information designated for release.
CCI-002184	The information system does not release information outside of the established system boundary unless organization-defined security safeguards are used to validate the appropriateness of the information designated for release.
CCI-002185	The organization defines the conditions on which it will employ an audited override of automated access control mechanisms.
CCI-002186	The organization employs an audited override of automated access control mechanisms under organization-defined conditions.
CCI-003014	The information system enforces organization-defined mandatory access control policies over all subjects and objects.
CCI-003015	The mandatory access control policy specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by some or all of the mandatory access control constraints.
CCI-002187	The organization defines the security attributes to be used to enforce organization-defined information flow control policies.
CCI-002188	The organization defines the information, source, and destination objects with which the organization-defined security attributes are to be associated.
CCI-002189	The organization defines the information flow control policies to be enforced for flow control decisions.
CCI-002190	The information system uses organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.
CCI-002191	The organization defines the information flow control policies to be enforced by the information system using protected processing domains.
CCI-002192	The organization defines the policies the information system is to enforce to achieve dynamic information flow control.
CCI-002193	The organization defines procedures or methods to be employed by the information system to prevent encrypted information from bypassing content-checking mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.
CCI-002194	The organization defines the metadata the information system uses to enforce information flow control.
CCI-002195	The organization defines the information flows against which the organization-defined security policy filters are to be enforced.
CCI-002196	The organization defines the information flows for which the information system will enforce the use of human reviews under organization-defined conditions.
CCI-002197	The organization defines the conditions which will require the use of human reviews of organization-defined information flows.
CCI-002198	The information system enforces the use of human reviews for organization-defined information flows under organization-defined conditions.
CCI-002199	The organization defines the conditions under which the information system provides the capability for privileged administrators to enable/disable organization-defined security policy filters.
CCI-002200	The organization defines the data type identifiers to be used to validate data being transferred between different security domains.
CCI-002201	The information system, when transferring information between different security domains, uses organization-defined data type identifiers to validate data essential for information flow decisions.
CCI-002202	The organization defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms.
CCI-002203	The organization defines the unsanctioned information the information system is to examine when transferring information between different security domains.
CCI-002204	The organization defines a security policy which prohibits the transfer of unsanctioned information between different security domains.
CCI-002205	The information system uniquely identifies and authenticates source by organization, system, application, and/or individual for information transfer.
CCI-002206	The information system uniquely authenticates source by organization, system, application, and/or individual for information transfer.
CCI-002207	The information system uniquely identifies and authenticates destination by organization, system, application, and/or individual for information transfer.
CCI-002208	The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.
CCI-002209	The organization defines the techniques to be used to bind security attributes to information.
CCI-002210	The information system binds security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.
CCI-002211	The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.
CCI-002212	The organization defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains.
CCI-002213	The organization defines the information to be subjected to flow control across security domains.
CCI-002214	The organization employs organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains.
CCI-002215	The organization defines the mechanisms and/or techniques to be used to logically or physically separate information flows.
CCI-002216	The organization defines the types of information required to accomplish logical or physical separation of information flows.
CCI-002217	The information system separates information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.
CCI-002218	The information system provides access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.
CCI-002219	The organization defines the duties of individuals that are to be separated.
CCI-002220	The organization defines information system access authorizations to support separation of duties.
CCI-002221	The organization defines the security-relevant information for which access must be explicitly authorized.
CCI-002222	The organization explicitly authorizes access to organization-defined security functions.
CCI-002223	The organization explicitly authorizes access to organization-defined security-relevant information.
CCI-002224	The organization defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.
CCI-002225	The information system provides separate processing domains to enable finer-grained allocation of user privileges.
CCI-002226	The organization defines the personnel or roles to whom privileged accounts are to be restricted on the information system.
CCI-002227	The organization restricts privileged accounts on the information system to organization-defined personnel or roles.
CCI-002228	The organization defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.
CCI-002229	The organization defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.
CCI-002230	The organization reviews the privileges assigned to organization-defined roles or classes of users on an organization-defined frequency to validate the need for such privileges.
CCI-002231	The organization reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
CCI-002232	The organization defines software that is restricted from executing at a higher privilege than users executing the software.
CCI-002233	The information system prevents organization-defined software from executing at higher privilege levels than users executing the software.
CCI-002234	The information system audits the execution of privileged functions.
CCI-002235	The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
CCI-002236	The organization defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.
CCI-002237	The organization defines the delay algorithm to be employed by the information system to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.
CCI-002238	The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.
CCI-002239	The organization defines the mobile devices that are to be purged/wiped by the information system after an organization-defined number of consecutive, unsuccessful device logon attempts.
CCI-002240	The organization defines the purging/wiping requirements/techniques to be used by the information system on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.
CCI-002241	The organization defines the number of consecutive, unsuccessful device logon attempts after which the information system will purge/wipe organization-defined mobile devices.
CCI-002242	The information system purges/wipes information from organization-defined mobile devices based on organization-defined purging/wiping requirements/techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.
CCI-002243	The organization-defined information system use notification message or banner is to state that users are accessing a U.S. Government information system.
CCI-002244	The organization-defined information system use notification message or banner is to state that information system usage may be monitored, recorded, and subject to audit.
CCI-002245	The organization-defined information system use notification message or banner is to state that unauthorized use of the information system is prohibited and subject to criminal and civil penalties.
CCI-002246	The organization-defined information system use notification message or banner is to state that use of the information system indicates consent to monitoring and recording.
CCI-002247	The organization defines the use notification message or banner the information system displays to users before granting access to the system.
CCI-002248	The organization defines the conditions of use which are to be displayed to users of the information system before granting further access.
CCI-002249	The organization defines the information, in addition to the date and time of the last logon (access), to be included in the notification to the user upon successful logon (access).
CCI-002250	The information system notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).
CCI-002251	The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access).
CCI-002252	The organization defines the accounts and/or account types for which the information system will limit the number of concurrent sessions.
CCI-002253	The organization defines the account types for which the information system will limit the number of concurrent sessions.
CCI-002255	The organization defines the user actions that can be performed on the information system without identification and authentication.
CCI-002256	The organization defines security attributes having organization-defined types of security attribute values which are associated with information in storage.
CCI-002257	The organization defines security attributes having organization-defined types of security attribute values which are associated with information in process.
CCI-002258	The organization defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission.
CCI-002259	The organization defines security attribute values associated with organization-defined types of security attributes for information in storage.
CCI-002260	The organization defines security attribute values associated with organization-defined types of security attributes for information in process.
CCI-002261	The organization defines security attribute values associated with organization-defined types of security attributes for information in transmission.
CCI-002262	The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.
CCI-002263	The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.
CCI-002264	The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.
CCI-002265	The organization ensures that the security attribute associations are made with the information.
CCI-002266	The organization ensures that the security attribute associations are retained with the information.
CCI-002267	The organization defines the security attributes that are permitted for organization-defined information systems.
CCI-002268	The organization defines the information systems for which permitted organization-defined attributes are to be established.
CCI-002269	The organization establishes the permitted organization-defined security attributes for organization-defined information systems.
CCI-002270	The organization defines the values or ranges permitted for each of the established security attributes.
CCI-002271	The organization determines the permitted organization-defined values or ranges for each of the established security attributes.
CCI-002272	The information system dynamically associates security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.
CCI-002273	The organization defines the security policies the information system is to adhere to when dynamically associating security attributes with organization-defined subjects and objects.
CCI-002274	The organization defines the subjects with which the information system is to dynamically associate security attributes as information is created and combined.
CCI-002275	The organization defines the objects with which the information system is to dynamically associate security attributes as information is created and combined.
CCI-002276	The organization identifies the individuals authorized to define the value of associated security attributes.
CCI-002277	The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.
CCI-002278	The organization defines security attributes for which the association and integrity to organization-defined subjects and objects is maintained by the information system.
CCI-002279	The organization defines subjects for which the association and integrity of organization-defined security attributes is maintained by the information system.
CCI-002280	The organization defines objects for which the association and integrity of organization-defined security attributes is maintained by the information system.
CCI-002281	The information system maintains the association of organization-defined security attributes to organization-defined subjects.
CCI-002282	The information system maintains the association of organization-defined security attributes to organization-defined objects.
CCI-002283	The information system maintains the integrity of organization-defined security attributes associated with organization-defined subjects.
CCI-002284	The information system maintains the integrity of organization-defined security attributes associated with organization-defined objects.
CCI-002285	The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined subjects.
CCI-002286	The organization defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).
CCI-002287	The organization defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).
CCI-002288	The organization defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.
CCI-002289	The information system supports the association of organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).
CCI-002290	The information system supports the association of organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).
CCI-002291	The organization defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects.
CCI-002292	The organization defines the security attributes which are to be associated with organization-defined subjects and objects.
CCI-002293	The organization defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.
CCI-002294	The organization defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.
CCI-002295	The organization allows personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.
CCI-002296	The organization allows personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.
CCI-002297	The organization allows personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.
CCI-002298	The organization allows personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.
CCI-002299	The organization provides a consistent interpretation of security attributes transmitted between distributed information system components.
CCI-002300	The organization defines the techniques or technologies to be implemented when associating security attributes with information.
CCI-002301	The organization defines the level of assurance to be provided when implementing organization-defined techniques or technologies in associating security attributes to information.
CCI-002302	The information system implements organization-defined techniques or technologies with an organization-defined level of assurance in associating security attributes to information.
CCI-002303	The organization defines the techniques or procedures to be employed to validate re-grading mechanisms.
CCI-002304	The organization ensures security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.
CCI-002305	The organization identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.
CCI-002306	The information system provides authorized individuals the capability to define or change the type of security attributes available for association with subjects.
CCI-002307	The information system provides authorized individuals the capability to define or change the value of security attributes available for association with subjects.
CCI-002308	The information system provides authorized individuals the capability to define or change the type of security attributes available for association with objects.
CCI-002309	The information system provides authorized individuals the capability to define or change the value of security attributes available for association with objects.
CCI-002310	The organization establishes and documents usage restrictions for each type of remote access allowed.
CCI-002311	The organization establishes and documents configuration/connection requirements for each type of remote access allowed.
CCI-002312	The organization establishes and documents implementation guidance for each type of remote access allowed.
CCI-002313	The information system controls remote access methods.
CCI-002314	The information system controls remote access methods.
CCI-002315	The organization defines the number of managed network access control points through which the information system routes all remote access.
CCI-002316	The organization authorizes access to security-relevant information via remote access only for organization-defined needs.
CCI-002317	The organization defines the operational needs for when the execution of privileged commands via remote access is to be authorized.
CCI-002318	The organization defines the operational needs for when access to security-relevant information via remote access is to be authorized.
CCI-002319	The organization documents in the security plan for the information system the rationale for authorization of the execution of privilege commands via remote access.
CCI-002320	The organization documents in the security plan for the information system the rationale for authorization of access to security-relevant information via remote access.
CCI-002321	The organization defines the time period within which it disconnects or disables remote access to the information system.
CCI-002322	The organization provides the capability to expeditiously disconnect or disable remote access to the information system within the organization-defined time period.
CCI-002323	The organization establishes configuration/connection requirements for wireless access.
CCI-002324	The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.
CCI-002325	The organization establishes configuration requirements for organization-controlled mobile devices.
CCI-002326	The organization establishes connection requirements for organization-controlled mobile devices.
CCI-002327	The organization defines the security policies which restrict the connection of classified mobile devices to classified information systems.
CCI-002328	The organization restricts the connection of classified mobile devices to classified information systems in accordance with organization-defined security policies.
CCI-002329	The organization defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device.
CCI-002330	The organization employs full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices.
CCI-002331	The organization employs full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices.
CCI-002332	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external information systems.
CCI-002333	The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002334	The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002335	The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002336	The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.
CCI-002337	The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization retains approved information system connection or processing agreements with the organizational entity hosting the external information system.
CCI-002338	The organization restricts or prohibits the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.
CCI-002339	The organization defines the network accessible storage devices that are to be prohibited from being used in external information systems.
CCI-002340	The organization prohibits the use of organization-defined network accessible storage devices in external information systems.
CCI-002341	The organization defines the information sharing restrictions to be enforced by the information system for information search and retrieval services.
CCI-002342	The information system implements information search and retrieval services that enforce organization-defined information sharing restrictions.
CCI-002343	The organization defines the data mining prevention techniques to be employed to adequately protect organization-defined data storage objects against data mining.
CCI-002344	The organization defines the data mining detection techniques to be employed to adequately detect data mining attempts against organization-defined data storage objects.
CCI-002345	The organization defines the data storage objects that are to be protected against data mining attempts.
CCI-002346	The organization employs organization-defined data mining prevention techniques for organization-defined data storage objects to adequately protect against data mining.
CCI-002347	The organization employs organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.
CCI-002348	The organization defines the access control decisions that are to be applied to each access request prior to access enforcement.
CCI-002349	The organization establishes procedures to ensure organization-defined access control decisions are applied to each access request prior to access enforcement.
CCI-002350	The organization defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined information systems that enforce access control decisions.
CCI-002351	The organization defines the security safeguards to be employed when transmitting organization-defined access authorization information to organization-defined information systems that enforce access control decisions.
CCI-002352	The organization defines the information systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.
CCI-002353	The information system transmits organization-defined access authorization information using organization-defined security safeguards to organization-defined information systems which enforce access control decisions.
CCI-002354	The organization defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.
CCI-002355	The information system enforces access control decisions based on organization-defined security attributes that do not include the identity of the user or process acting on behalf of the user.
CCI-002356	The organization defines the access control policies to be implemented by the information system^s reference monitor.
CCI-002357	The information system implements a reference monitor for organization-defined access control policies that is tamperproof.
CCI-002358	The information system implements a reference monitor for organization-defined access control policies that is always invoked.
CCI-002359	The information system implements a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.
CCI-002048	The organization defines the personnel or roles to whom the security awareness and training policy is disseminated.
CCI-002049	The organization defines the personnel or roles to whom the security awareness and training procedures are disseminated.
CCI-002055	The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
CCI-002050	The organization defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.
CCI-002051	The organization defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.
CCI-002052	The organization includes practical exercises in security training that reinforce training objectives.
CCI-002053	The organization provides training to its personnel on organization-defined indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.
CCI-002054	The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.
CCI-001831	The organization documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001832	The organization disseminates the audit and accountability policy to organization-defined personnel or roles.
CCI-001833	The organization documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
CCI-001834	The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
CCI-001835	The organization defines the frequency on which it will review the audit and accountability policy.
CCI-001836	The organization defines the frequency on which it will update the audit and accountability policy.
CCI-001837	The organization reviews the audit and accountability policy on an organization-defined frequency.
CCI-001838	The organization updates the audit and accountability policy on an organization-defined frequency.
CCI-001839	The organization defines the frequency on which it will review the audit and accountability procedures.
CCI-001840	The organization defines the frequency on which it will update the audit and accountability procedures.
CCI-001841	The organization reviews the audit and accountability procedures on an organization-defined frequency.
CCI-001842	The organization updates the audit and accountability procedures on an organization-defined frequency.
CCI-001930	The organization defines the organizational personnel or roles to whom the audit and accountability policy is to be disseminated.
CCI-001931	The organization defines the organizational personnel or roles to whom the audit and accountability procedures are to be disseminated.
CCI-001843	The organization defines a frequency for updating the list of organization-defined auditable events.
CCI-001844	The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.
CCI-001845	The information system provides centralized configuration of the content to be captured in audit records generated by organization-defined information system components.
CCI-001846	The organization defines information system components that will generate the audit records which are to be captured for centralized management of the content.
CCI-001847	The organization defines information system components that will generate the audit records which are to be captured for centralized configuration of the content.
CCI-001848	The organization defines the audit record storage requirements.
CCI-001849	The organization allocates audit record storage capacity in accordance with organization-defined audit record storage requirements.
CCI-001850	The organization defines the frequency on which the information system off-loads audit records onto a different system or media than the system being audited.
CCI-001851	The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.
CCI-001852	The organization defines the personnel, roles and/or locations to receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity.
CCI-001853	The organization defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit record storage volume reaches an organization-defined percentage of maximum audit records storage capacity.
CCI-001854	The organization defines the percentage of maximum audit record storage capacity that is to be reached, at which time the information system will provide a warning to organization-defined personnel, roles, and/or locations.
CCI-001855	The information system provides a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit record storage volume reaches an organization-defined percentage of repository maximum audit record storage capacity.
CCI-001856	The organization defines the real-time period within which the information system is to provide an alert when organization-defined audit failure events occur.
CCI-001857	The organization defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.
CCI-001858	The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
CCI-001859	The organization defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.
CCI-001860	The organization defines the audit failures which, should they occur, will invoke an organization-defined system mode.
CCI-001861	The information system invokes an organization-defined system mode, in the event of organization-defined audit failures, unless an alternate audit capability exists.
CCI-002907	The organization defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission/business functionality available, in the event of organization-defined audit failures.
CCI-001862	The organization defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.
CCI-001863	The organization defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.
CCI-001864	The organization employs automated mechanisms to integrate audit review and analysis to support organizational processes for investigation of and response to suspicious activities.
CCI-001865	The organization employs automated mechanisms to integrate reporting processes to support organizational investigation of and response to suspicious activities.
CCI-001866	The organization defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.
CCI-001867	The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, information system monitoring information, and/or organization-defined data/information collected from other sources to further enhance its ability to identify inappropriate or unusual activity.
CCI-001868	The organization specifies the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.
CCI-001869	The organization specifies the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.
CCI-001870	The organization performs a full-text analysis of audited privileged commands in a physically-distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.
CCI-001871	The organization correlates information from non-technical sources with audit information to enhance organization-wide situational awareness.
CCI-001872	The organization adjusts the level of audit review and analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
CCI-001873	The organization adjusts the level of audit analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
CCI-001874	The organization adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
CCI-001875	The information system provides an audit reduction capability that supports on-demand audit review and analysis.
CCI-001876	The information system provides an audit reduction capability that supports on-demand reporting requirements.
CCI-001877	The information system provides an audit reduction capability that supports after-the-fact investigations of security incidents.
CCI-001878	The information system provides a report generation capability that supports on-demand audit review and analysis.
CCI-001879	The information system provides a report generation capability that supports on-demand reporting requirements.
CCI-001880	The information system provides a report generation capability that supports after-the-fact investigations of security incidents.
CCI-001881	The information system provides an audit reduction capability that does not alter original content or time ordering of audit records.
CCI-001882	The information system provides a report generation capability that does not alter original content or time ordering of audit records.
CCI-001883	The organization defines the audit fields within audit records to be processed for events of interest by the information system.
CCI-001884	The organization defines the audit fields within audit records to be sorted for events of interest by the information system.
CCI-001885	The organization defines the audit fields within audit records to be searched for events of interest by the information system.
CCI-001886	The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records.
CCI-001887	The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records.
CCI-001888	The organization defines the granularity of time measurement for time stamps generated for audit records.
CCI-001889	The information system records time stamps for audit records that meet organization-defined granularity of time measurement.
CCI-001890	The information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
CCI-001891	The information system compares internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.
CCI-001892	The organization defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks to the organization-defined authoritative time source.
CCI-001893	The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.
CCI-002046	The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.
CCI-001894	The organization defines the subset of privileged users who will be authorized access to the management of audit functionality.
CCI-001895	The organization defines the audit information requiring dual authorization for movement or deletion actions.
CCI-001896	The organization enforces dual authorization for movement and/or deletion of organization-defined audit information.
CCI-001897	The organization defines the subset of privileged users who will be authorized read-only access to audit information.
CCI-001898	The organization authorizes read-only access to audit information to an organization-defined subset of privileged users.
CCI-001899	The organization defines the actions to be covered by non-repudiation.
CCI-001900	The organization defines the strength of binding to be applied to the binding of the identity of the information producer with the information.
CCI-001901	The information system binds the identity of the information producer with the information to an organization-defined strength of binding.
CCI-001902	The information system provides the means for authorized individuals to determine the identity of the producer of the information.
CCI-001903	The organization defines the frequency on which the information system is to validate the binding of the information producer identity to the information.
CCI-001904	The information system validates the binding of the information producer identity to the information at an organization-defined frequency.
CCI-001905	The organization defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.
CCI-001906	The information system performs organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.
CCI-001907	The organization defines the security domains which will require the information system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.
CCI-001908	The organization defines the action the information system is to perform in the event of an information reviewer identity binding validation error.
CCI-001909	The information system performs organization-defined actions in the event of an information reviewer identity binding validation error.
CCI-002044	The organization defines measures to be employed to ensure that long-term audit records generated by the information system can be retrieved.
CCI-002045	The organization employs organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved.
CCI-001910	The organization defines the personnel or roles allowed to select which auditable events are to be audited by specific components of the information system.
CCI-001911	The organization defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined information system components, by organization-defined individuals or roles, within organization-defined time thresholds.
CCI-001912	The organization defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.
CCI-001913	The organization defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds.
CCI-001914	The information system provides the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined information system components based on organization-defined selectable event criteria within organization-defined time thresholds.
CCI-002047	The organization defines the information system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles.
CCI-001915	The organization defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.
CCI-001916	The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.
CCI-001917	The organization defines the frequency for reviewing the open source information sites being monitored.
CCI-001918	The organization reviews the open source information sites being monitored per organization-defined frequency.
CCI-001919	The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
CCI-001920	The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.
CCI-001921	The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.
CCI-001922	The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.
CCI-001923	The organization defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.
CCI-001924	The organization defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.
CCI-001925	The organization employs organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.
CCI-001926	The organization requires that the identity of individuals be preserved in cross-organizational audit trails.
CCI-001927	The organization defines the organizations that will be provided cross-organizational audit information.
CCI-001928	The organization defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information.
CCI-001929	The organization provides cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements.
CCI-002060	The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-002061	The organization defines the personnel or roles to whom security assessment and authorization policy is to be disseminated.
CCI-002062	The organization defines the personnel or roles to whom the security assessment and authorization procedures are to be disseminated.
CCI-002063	The organization defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.
CCI-002064	The organization selects one or more security assessment techniques to be conducted.
CCI-002065	The organization defines the frequency at which to conduct security control assessments.
CCI-002066	The organization accepts the results of an assessment of the organization-defined information system performed by an organization-defined external organization when the assessment meets organization-defined requirements.
CCI-002067	The organization defines the information systems for which they will accept the results of an assessment performed by an external organization.
CCI-002068	The organization defines the external organizations from which assessment results for organization-defined information systems will be accepted.
CCI-002069	The organization defines the requirements the assessments for organization-defined information systems from organization-defined external organizations must meet.
CCI-002070	The organization^s security assessment plan describes the assessment team, and assessment roles and responsibilities.
CCI-002071	The organization defines the individuals or roles to whom the results of the security control assessment are to be provided.
CCI-002072	The organization defines the unclassified, national security systems that are prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.
CCI-002073	The organization defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network.
CCI-002074	The organization defines the boundary protection device to be used for the direct connection of classified, national security system to an external network.
CCI-002075	The organization prohibits the direct connection of an organization-defined unclassified, non-national security system to an external network without the use of organization-defined boundary protection device.
CCI-002076	The organization defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.
CCI-002077	The organization defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.
CCI-002078	The organization prohibits the direct connection of an organization-defined information system to a public network.
CCI-002079	The organization defines the information system that is prohibited from directly connecting to a public network.
CCI-002080	The organization employs either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.
CCI-002081	The organization defines the information systems that employ either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing connections to external information systems.
CCI-002082	The organization selects either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.
CCI-002083	The organization reviews and updates Interconnection Security Agreements on an organization-defined frequency.
CCI-002084	The organization defines the frequency at which reviews and updates to the Interconnection Security Agreements must be conducted.
CCI-002085	The organization defines the level of independence the assessors or assessment teams must have to monitor the security controls in the information system on an ongoing basis.
CCI-002086	The organization employs trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data.
CCI-002087	The organization establishes and defines the metrics to be monitored for the continuous monitoring program.
CCI-002088	The organization establishes and defines the frequencies for continuous monitoring.
CCI-002089	The organization establishes and defines the frequencies for assessments supporting continuous monitoring.
CCI-002090	The organization implements a continuous monitoring program that includes ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy.
CCI-002091	The organization implements a continuous monitoring program that includes correlation and analysis of security-related information generated by assessments and monitoring.
CCI-002092	The organization implements a continuous monitoring program that includes response actions to address results of the analysis of security-related information.
CCI-002093	The organization conducts penetration testing in accordance with organization-defined frequency on organization-defined information systems or system components.
CCI-002094	The organization defines the frequency for conducting penetration testing on organization-defined information systems or system components.
CCI-002095	The organization defines the information systems or system components on which penetration testing will be conducted.
CCI-002096	The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.
CCI-002097	The organization defines red team exercises to simulate attempts by adversaries to compromise organizational information systems.
CCI-002098	The organization defines rules of engagement for red team exercises to simulate attempts by adversaries to compromise organizational information systems.
CCI-002099	The organization employs organization-defined red team exercises to simulate attempts by adversaries to compromise organizational information systems in accordance with organization-defined rules of engagement.
CCI-002100	The information system performs security compliance checks on constituent components prior to the establishment of the internal connection.
CCI-002101	The organization authorizes internal connections of organization-defined information system components or classes of components to the information system.
CCI-002102	The organization defines the information system components or classes of components that are authorized internal connections to the information system.
CCI-002103	The organization documents, for each internal connection, the interface characteristics.
CCI-002104	The organization documents, for each internal connection, the security requirements.
CCI-002105	The organization documents, for each internal connection, the nature of the information communicated.
CCI-001820	The organization documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001821	The organization defines the organizational personnel or roles to whom the configuration management policy is to be disseminated.
CCI-001822	The organization disseminates the configuration management policy to organization-defined personnel or roles.
CCI-001823	The organization documents the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
CCI-001824	The organization defines the organizational personnel or roles to whom the configuration management procedures are to be disseminated.
CCI-001825	The organization disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
CCI-001736	The organization defines the previous versions of the baseline configuration of the information system required to support rollback.
CCI-001737	The organization defines the information systems, system components, or devices that are to have organization-defined configurations applied when located in areas of significant risk.
CCI-001738	The organization defines the security configurations to be implemented on information systems, system components, or devices when they are located in areas of significant risk.
CCI-001739	The organization issues organization-defined information systems, system components, or devices with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk.
CCI-001815	The organization defines the security safeguards to be applied to devices when they return from areas of significant risk.
CCI-001816	The organization applies organization-defined security safeguards to devices when individuals return from areas of significant risk.
CCI-001740	The organization reviews proposed configuration-controlled changes to the information system.
CCI-001741	The organization documents configuration change decisions associated with the information system.
CCI-001742	The organization defines the approval authorities to be notified when proposed changes to the information system are received.
CCI-001743	The organization defines the security responses to be automatically implemented by the information system if baseline configurations are changed in an unauthorized manner.
CCI-001744	The information system implements organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
CCI-001745	The organization defines the security safeguards that are to be provided by the cryptographic mechanisms which are employed by the organization.
CCI-001746	The organization ensures that cryptographic mechanisms used to provide organization-defined security safeguards are under configuration management.
CCI-001819	The organization implements approved configuration-controlled changes to the information system.
CCI-002056	The organization defines the time period the records of configuration-controlled changes are to be retained.
CCI-002057	The organization defines the personnel to be notified when approved changes to the information system are completed.
CCI-002058	The organization employs automated mechanisms to notify organization-defined personnel when approved changes to the information system are completed.
CCI-001817	The organization, when analyzing changes to the information system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CCI-001818	The organization analyzes changes to the information system in a separate test environment before installation in an operational environment.
CCI-001747	The organization defines critical software components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.
CCI-001748	The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.
CCI-001749	The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
CCI-001750	The information system prevents the installation of organization-defined firmware components without verification the firmware component has been digitally signed using a certificate that is recognized and approved by the organization.
CCI-001751	The organization defines system-level information requiring enforcement of a dual authorization for information system changes.
CCI-001752	The organization enforces dual authorization for changes to organization-defined system-level information.
CCI-001753	The organization limits privileges to change information system components within a production or operational environment.
CCI-001754	The organization limits privileges to change system-related information within a production or operational environment.
CCI-001813	The information system enforces access restrictions.
CCI-001814	The Information system supports auditing of the enforcement actions.
CCI-001826	The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred.
CCI-001827	The organization defines the frequency with which to review information system privileges.
CCI-001828	The organization defines the frequency with which to reevaluate information system privileges.
CCI-001829	The organization reviews information system privileges per an organization-defined frequency.
CCI-001830	The organization reevaluates information system privileges per an organization-defined frequency.
CCI-001755	The organization defines the information system components for which any deviation from the established configuration settings are to be identified, documented, and approved.
CCI-001756	The organization defines the operational requirements on which the configuration settings for the organization-defined information system components are to be based.
CCI-001757	The organization defines the security safeguards the organization is to employ when responding to unauthorized changes to the organization-defined configuration settings.
CCI-001758	The organization defines configuration settings for which the organization will employ organization-defined security safeguards in response to unauthorized changes.
CCI-001759	The organization employs organization-defined security safeguards to respond to unauthorized changes to organization-defined configuration settings.
CCI-002059	The organization defines the information system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.
CCI-001760	The organization defines the frequency of information system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, and services.
CCI-001761	The organization defines the functions, ports, protocols, and services within the information system that are to be disabled when deemed unnecessary and/or nonsecure.
CCI-001762	The organization disables organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure.
CCI-001763	The organization defines the policies regarding software program usage and restrictions.
CCI-001764	The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.
CCI-001765	The organization defines the software programs not authorized to execute on the information system.
CCI-001766	The organization identifies the organization-defined software programs not authorized to execute on the information system.
CCI-001767	The organization employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system.
CCI-001768	The organization defines the frequency on which it will review and update the list of unauthorized software programs.
CCI-001769	The organization defines the frequency on which it will update the list of unauthorized software programs.
CCI-001770	The organization reviews and updates the list of unauthorized software programs per organization-defined frequency.
CCI-001771	The organization updates the list of unauthorized software programs per organization-defined frequency.
CCI-001772	The organization defines the software programs authorized to execute on the information system.
CCI-001773	The organization identifies the organization-defined software programs authorized to execute on the information system.
CCI-001774	The organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system.
CCI-001775	The organization defines the frequency on which it will review and update the list of authorized software programs.
CCI-001776	The organization defines the frequency on which it will update the list of authorized software programs.
CCI-001777	The organization reviews and updates the list of authorized software programs per organization-defined frequency.
CCI-001778	The organization updates the list of authorized software programs per organization-defined frequency.
CCI-001779	The organization defines the frequency on which the information system component inventory is to be reviewed and updated.
CCI-001780	The organization reviews and updates the information system component inventory per organization-defined frequency.
CCI-001781	The organization defines the frequency on which the information system component inventory is to be updated.
CCI-001782	The organization updates the information system component inventory per organization-defined frequency.
CCI-001783	The organization defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system.
CCI-001784	When unauthorized hardware, software, and firmware components are detected within the information system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.
CCI-001785	The organization provides a centralized repository for the inventory of information system components.
CCI-001786	The organization employs automated mechanisms to support tracking of information system components by geographic location.
CCI-001787	The organization defines the acquired information system components that are to be assigned to an information system.
CCI-001788	The organization assigns organization-defined acquired information system components to an information system.
CCI-001789	The organization receives an acknowledgement from the information system owner of the assignment of the acquired information system components to an information system.
CCI-001790	The organization develops a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.
CCI-001791	The organization documents a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.
CCI-001792	The organization implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.
CCI-001793	The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
CCI-001794	The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
CCI-001795	The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
CCI-001796	The organization develops a configuration management plan for the information system that places the configuration items under configuration management.
CCI-001797	The organization documents a configuration management plan for the information system that places the configuration items under configuration management.
CCI-001798	The organization implements a configuration management plan for the information system that places the configuration items under configuration management.
CCI-001799	The organization develops and documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.
CCI-001800	The organization documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.
CCI-001801	The organization implements a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.
CCI-001726	The organization uses software in accordance with contract agreements.
CCI-001727	The organization uses software documentation in accordance with contract agreements.
CCI-001728	The organization uses software in accordance with copyright laws.
CCI-001729	The organization uses software documentation in accordance with copyright laws.
CCI-001730	The organization tracks the use of software protected by quantity licenses to control copying of the software.
CCI-001731	The organization tracks the use of software documentation protected by quantity licenses to control distribution of the software documentation.
CCI-001732	The organization controls the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CCI-001733	The organization documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CCI-001734	The organization defines the restrictions to be followed on the use of open source software.
CCI-001735	The organization establishes organization-defined restrictions on the use of open source software.
CCI-001802	The organization tracks the use of software documentation protected by quantity licenses to control copying of the software documentation.
CCI-001803	The organization tracks the use of software protected by quantity licenses to control distribution of the software.
CCI-001804	The organization defines the policies for governing the installation of software by users.
CCI-001805	The organization establishes organization-defined policies governing the installation of software by users.
CCI-001806	The organization defines methods to be employed to enforce the software installation policies.
CCI-001807	The organization enforces software installation policies through organization-defined methods.
CCI-001808	The organization defines the frequency on which it will monitor software installation policy compliance.
CCI-001809	The organization monitors software installation policy compliance per an organization-defined frequency.
CCI-001810	The organization defines the personnel or roles to be notified when unauthorized software is detected.
CCI-001811	The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected.
CCI-001812	The information system prohibits user installation of software without explicit privileged status.
CCI-002825	The organization defines personnel or roles to whom the contingency planning policy is to be disseminated.
CCI-002826	The organization defines personnel or roles to whom the contingency planning procedures are disseminated.
CCI-002827	The organization coordinates its contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.
CCI-002828	The organization identifies critical information system assets supporting essential missions.
CCI-002829	The organization identifies critical information system assets supporting essential business functions.
CCI-002830	The organization defines the personnel or roles who review and approve the contingency plan for the information system.
CCI-002831	The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.
CCI-002832	The organization protects the contingency plan from unauthorized disclosure and modification.
CCI-002833	The organization defines the time period that contingency training is to be provided to information system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.
CCI-002834	The organization provides contingency training to information system users consistent with assigned roles and responsibilities when required by information system changes.
CCI-002835	The organization tests the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.
CCI-002836	The organization ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CCI-002837	The organization plans for circumstances that preclude returning to the primary processing site.
CCI-002838	The organization prepares for circumstances that preclude returning to the primary processing site.
CCI-002839	The organization defines information system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.
CCI-002840	The organization defines the information system operations to be resumed for essential missions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-002841	The organization defines the information system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
CCI-002842	The organization reviews provider contingency plans to ensure that the plans meet organizational contingency requirements.
CCI-002843	The organization defines the frequency with which to obtain evidence of contingency testing by providers.
CCI-002844	The organization defines the frequency with which to obtain evidence of contingency training by providers.
CCI-002845	The organization obtains evidence of contingency testing by providers in accordance with organization-defined frequency.
CCI-002846	The organization obtains evidence of contingency training by providers in accordance with organization-defined frequency.
CCI-002847	The organization defines the frequency with which to test alternate telecommunication services.
CCI-002848	The organization tests alternate telecommunication services per organization-defined frequency.
CCI-002849	The organization defines critical information system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container.
CCI-002850	The organization stores backup copies of organization-defined critical information system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system.
CCI-002851	The organization defines the backup information that requires dual authorization for deletion or destruction.
CCI-002852	The organization enforces dual authorization for the deletion or destruction of organization-defined backup information.
CCI-002853	The information system provides the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.
CCI-002854	The organization defines the alternative communications protocols the information system must be capable of providing in support of maintaining continuity of operations.
CCI-002855	The information system, when organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation.
CCI-002856	The organization defines the conditions that, when detected, the information system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.
CCI-002857	The organization defines the restrictions of the safe mode of operation that the information system will enter when organization-defined conditions are detected.
CCI-002858	The organization employs organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.
CCI-002859	The organization defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.
CCI-002860	The organization defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised.
CCI-001932	The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
CCI-001933	The organization defines the personnel or roles to be recipients of the identification and authentication policy and the procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
CCI-001934	The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
CCI-001935	The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to privileged accounts.
CCI-001936	The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-001937	The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements.
CCI-001938	The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to non-privileged accounts.
CCI-001939	The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-001940	The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements.
CCI-001941	The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.
CCI-001942	The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.
CCI-001943	The organization defines the information system accounts for which single sign-on capability will be provided.
CCI-001944	The organization defines the information system services for which single sign-on capability will be provided.
CCI-001945	The information system provides a single sign-on capability for an organization-defined list of information system accounts.
CCI-001946	The information system provides a single sign-on capability for an organization-defined list of information system services.
CCI-001947	The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to privileged accounts.
CCI-001948	The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-001949	The device used in the information system implementation of multifactor authentication for remote access to privileged accounts meets organization-defined strength of mechanism requirements.
CCI-001950	The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to non-privileged accounts.
CCI-001951	The information system implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-001952	The device used in the information system implementation of multifactor authentication for remote access to non-privileged accounts meets organization-defined strength of mechanism requirements.
CCI-001953	The information system accepts Personal Identity Verification (PIV) credentials.
CCI-001954	The information system electronically verifies Personal Identity Verification (PIV) credentials.
CCI-001955	The organization defines the out-of-band authentication to be implemented by the information system under organization-defined conditions.
CCI-001956	The organization defines the conditions for which the information system implements organization-defined out-of-band authentication.
CCI-001957	The information system implements organization-defined out-of-band authentication under organization-defined conditions.
CCI-001958	The information system authenticates an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.
CCI-001959	The organization defines the specific devices and/or type of devices the information system is to authenticate before establishing a connection.
CCI-001960	The organization defines the lease information to be assigned to devices.
CCI-001961	The organization defines the lease duration to be assigned to devices.
CCI-001962	The organization standardizes dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information.
CCI-001963	The organization standardizes dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration.
CCI-001964	The organization defines the configuration management process that is to handle the device identification procedures.
CCI-001965	The organization defines the configuration management process that is to handle the device authentication procedures.
CCI-001966	The organization ensures that device identification based on attestation is handled by the organization-defined configuration management process.
CCI-001967	The information system authenticates organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
CCI-001968	The organization defines the configuration management process that is to handle the device identification procedures.
CCI-001969	The organization ensures that device authentication based on attestation is handled by the organization-defined configuration management process.
CCI-001970	The organization defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers.
CCI-001971	The organization manages information system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier.
CCI-001972	The organization manages information system identifiers by selecting an identifier that identifies an individual, group, role, or device.
CCI-001973	The organization manages information system identifiers by assigning the identifier to the intended individual, group, role, or device.
CCI-001974	The organization defines the time period for which the reuse of identifiers is prohibited.
CCI-001975	The organization manages information system identifiers by preventing reuse of identifiers for an organization-defined time period.
CCI-001976	The information system dynamically manages identifiers.
CCI-001977	The organization defines the external organizations with which it will coordinate for cross-management of identifiers.
CCI-001978	The organization coordinates with organization-defined external organizations for cross-organization management of identifiers.
CCI-001979	The organization requires the registration process to receive an individual identifier be conducted in person before a designated registration authority.
CCI-002040	The organization requires that the registration process to receive an individual identifier includes supervisor authorization.
CCI-001980	The organization manages information system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator.
CCI-001981	The organization manages information system authenticators by establishing administrative procedures for initial authenticator distribution.
CCI-001982	The organization manages information system authenticators by establishing administrative procedures for lost/compromised authenticators.
CCI-001983	The organization manages information system authenticators by establishing administrative procedures for damaged authenticators.
CCI-001984	The organization manages information system authenticators by establishing administrative procedures for revoking authenticators.
CCI-001985	The organization manages information system authenticators by implementing administrative procedures for initial authenticator distribution.
CCI-001986	The organization manages information system authenticators by implementing administrative procedures for lost/compromised authenticators.
CCI-001987	The organization manages information system authenticators by implementing administrative procedures for damaged authenticators.
CCI-001988	The organization manages information system authenticators by implementing administrative procedures for revoking authenticators.
CCI-001989	The organization manages information system authenticators by changing default content of authenticators prior to information system installation.
CCI-001990	The organization manages information system authenticators by changing authenticators for group/role accounts when membership to those accounts changes.
CCI-001991	The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.
CCI-001992	The organization defines the personnel or roles responsible for authorizing the organization^s registration authority accountable for the authenticator registration process.
CCI-001993	The organization defines the registration authority accountable for the authenticator registration process.
CCI-001994	The organization defines the types of and/or specific authenticators that are subject to the authenticator registration process.
CCI-001995	The organization requires that the registration process, to receive organization-defined types of and/or specific authenticators, be conducted in person, or by a trusted third-party, before an organization-defined registration authority with authorization by organization-defined personnel or roles.
CCI-001996	The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong.
CCI-001997	The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements.
CCI-001998	The organization requires developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.
CCI-001999	The organization defines the external organizations to be coordinated with for cross-organization management of credentials.
CCI-002000	The organization coordinates with organization-defined external organizations for cross-organization management of credentials.
CCI-002001	The information system dynamically provisions identities.
CCI-002002	The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.
CCI-002003	The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.
CCI-002004	The organization defines the biometric quality requirements to be employed by the information system mechanisms for biometric-based authentication.
CCI-002005	The information system, for biometric-based authentication, employs mechanisms that satisfy organization-defined biometric quality requirements.
CCI-002006	The organization defines the time period after which the use of cached authenticators is prohibited.
CCI-002007	The information system prohibits the use of cached authenticators after an organization-defined time period.
CCI-002008	The organization, for PKI-based authentication, employs a deliberate organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.
CCI-002041	The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.
CCI-002042	The organization manages information system authenticators by protecting authenticator content from unauthorized modification.
CCI-002043	The organization uses only FICAM-approved path discovery and validation products and services.
CCI-002365	The organization manages information system authenticators by requiring individuals to take specific security safeguards to protect authenticators.
CCI-002366	The organization manages information system authenticators by having devices implement specific security safeguards to protect authenticators.
CCI-002367	The organization ensures unencrypted static authenticators are not embedded in applications.
CCI-002009	The information system accepts Personal Identity Verification (PIV) credentials from other federal agencies.
CCI-002010	The information system electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.
CCI-002011	The information system accepts FICAM-approved third-party credentials.
CCI-002012	The organization defines the information systems which will employ only FICAM-approved information system components.
CCI-002013	The organization employs only FICAM-approved information system components in organization-defined information systems to accept third-party credentials.
CCI-002014	The information system conforms to FICAM-issued profiles.
CCI-002015	The information system accepts Personal Identity Verification-I (PIV-I) credentials.
CCI-002016	The information system electronically verifies Personal Identity Verification-I (PIV-I) credentials.
CCI-002017	The organization defines the information system services requiring identification.
CCI-002018	The organization defines the information system services requiring authentication.
CCI-002019	The organization defines the security safeguards to be used when identifying information system services.
CCI-002020	The organization defines the security safeguards to be used when authenticating information system services.
CCI-002021	The organization identifies organization-defined information system services using organization-defined security safeguards.
CCI-002022	The organization authenticates organization-defined information system services using organization-defined security safeguards.
CCI-002023	The organization ensures that service providers receive identification information.
CCI-002024	The organization ensures that service providers validate identification information.
CCI-002025	The organization ensures that service providers transmit identification information.
CCI-002026	The organization ensures that service providers receive authentication information.
CCI-002027	The organization ensures that service providers validate authentication information.
CCI-002028	The organization ensures that service providers transmit authentication information.
CCI-002029	The organization defines the services between which identification decisions are to be transmitted.
CCI-002030	The organization defines the services between which authentication decisions are to be transmitted.
CCI-002031	The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies.
CCI-002032	The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.
CCI-002033	The organization defines the specific circumstances or situations when individuals accessing an information system employ organization-defined supplemental authentication techniques or mechanisms.
CCI-002034	The organization defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the information system.
CCI-002035	The organization requires that individuals accessing the information system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations.
CCI-002036	The organization defines the circumstances or situations under which users will be required to reauthenticate.
CCI-002037	The organization defines the circumstances or situations under which devices will be required to reauthenticate.
CCI-002038	The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.
CCI-002039	The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.
CCI-002776	The organization defines the personnel or roles to whom the incident response policy is disseminated.
CCI-002777	The organization defines the personnel or roles to whom the incident response procedures are disseminated.
CCI-002778	The organization defines the time period in which information system users who assume an incident response role or responsibility receive incident response training.
CCI-002779	The organization provides incident response training to information system users consistent with assigned roles and responsibilities when required by information system changes.
CCI-002780	The organization coordinates incident response testing with organizational elements responsible for related plans.
CCI-002781	The organization defines the information system components for dynamic reconfiguration as part of the incident response capability.
CCI-002782	The organization implements an incident handling capability for insider threats.
CCI-002783	The organization coordinates an incident handling capability for insider threats across organization-defined components or elements of the organization.
CCI-002784	The organization defines components or elements of the organization across which an incident handling capability for insider threats will be coordinated.
CCI-002785	The organization coordinates with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.
CCI-002786	The organization defines external organizations with which to correlate and share organization-defined incident information.
CCI-002787	The organization defines incident information to correlate and share with organization-defined external organizations.
CCI-002788	The organization employs organization-defined dynamic response capabilities to effectively respond to security incidents.
CCI-002789	The organization defines dynamic response capabilities to effectively respond to security incidents.
CCI-002790	The organization coordinates incident handling activities involving supply chain events with other organizations involved in the supply chain.
CCI-002791	The organization defines authorities to whom security incident information is reported.
CCI-002792	The organization defines personnel or roles to whom information system vulnerabilities associated with reported security incident information are reported.
CCI-002793	The organization provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.
CCI-002794	The organization develops an incident response plan.
CCI-002795	The organization^s incident response plan provides the organization with a roadmap for implementing its incident response capability.
CCI-002796	The organization^s incident response plan describes the structure and organization of the incident response capability.
CCI-002797	The organization^s incident response plan provides a high-level approach for how the incident response capability fits into the overall organization.
CCI-002798	The organization^s incident response plan meets the unique requirements of the organization, which relate to mission, size, structure, and functions.
CCI-002799	The organization^s incident response plan defines reportable incidents.
CCI-002800	The organization^s incident response plan provides metrics for measuring the incident response capability within the organization.
CCI-002801	The organization^s incident response plan defines the resources and management support needed to effectively maintain and mature an incident response capability.
CCI-002802	The organization defines personnel or roles to review and approve the incident response plan.
CCI-002803	The organization defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.
CCI-002804	The organization protects the incident response plan from unauthorized disclosure and modification.
CCI-002805	The organization responds to information spills by identifying the specific information involved in the information system contamination.
CCI-002806	The organization responds to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill.
CCI-002807	The organization defines personnel or roles to be alerted of information spills using a method of communication not associated with the spill.
CCI-002808	The organization responds to information spills by isolating the contaminated information system or system component.
CCI-002809	The organization responds to information spills by eradicating the information from the contaminated information system or component.
CCI-002810	The organization responds to information spills by identifying other information systems or system components that may have been subsequently contaminated.
CCI-002811	The organization responds to information spills by performing other organization-defined actions.
CCI-002812	The organization defines other actions required to respond to information spills.
CCI-002813	The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.
CCI-002814	The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.
CCI-002815	The organization defines personnel or roles to whom responsibility for responding to information spills will be assigned.
CCI-002816	The organization provides information spillage response training according to an organization-defined frequency.
CCI-002817	The organization defines the frequency with which to provide information spillage response training.
CCI-002818	The organization implements organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
CCI-002819	The organization defines procedures to implement to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
CCI-002820	The organization employs organization-defined security safeguards for personnel exposed to information not within assigned access authorizations.
CCI-002821	The organization defines security safeguards to employ for personnel exposed to information not within assigned access authorizations.
CCI-002822	The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.
CCI-002861	The organization defines the personnel or roles to whom a system maintenance policy is disseminated.
CCI-002862	The organization defines the personnel or roles to whom system maintenance procedures are to be disseminated.
CCI-002863	The organization employs automated mechanisms to schedule, conduct, and document repairs.
CCI-002864	The organization produces up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.
CCI-002865	The organization produces up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.
CCI-002866	The organization schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002867	The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002868	The organization documents maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002869	The organization reviews records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002870	The organization schedules repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002871	The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002872	The organization documents repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002873	The organization reviews records of repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
CCI-002874	The organization defines the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.
CCI-002875	The organization includes organization-defined maintenance-related information in organizational maintenance records.
CCI-002876	The organization defines the maintenance-related information to include in organizational maintenance records.
CCI-002905	The organization employs automated mechanisms to schedule, conduct, and document maintenance.
CCI-002877	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by verifying that there is no organizational information contained on the equipment.
CCI-002878	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by sanitizing or destroying the equipment.
CCI-002879	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.
CCI-002880	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.
CCI-002881	The organization prevents the unauthorized removal of maintenance equipment containing organizational information by obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.
CCI-002882	The organization defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.
CCI-002883	The information system restricts the use of maintenance tools to authorized personnel only.
CCI-002884	The organization audits nonlocal maintenance and diagnostic sessions^ organization-defined audit events.
CCI-002885	The organization defines the nonlocal maintenance and diagnostic session audit events to audit.
CCI-002886	The organization reviews the records of the nonlocal maintenance and diagnostic sessions.
CCI-002887	The organization defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.
CCI-002888	The organization defines the personnel or roles authorized to approve each nonlocal maintenance session.
CCI-002889	The organization notifies organization-defined personnel or roles of the date and time of planned nonlocal maintenance.
CCI-002890	The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
CCI-002891	The information system implements remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.
CCI-003123	The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
CCI-002892	The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
CCI-002893	The organization ensures that non-escorted personnel performing maintenance activities not directly associated with the information system but in the physical proximity of the system, have required access authorization.
CCI-002894	The organization ensures that non-escorted personnel performing maintenance on the information system have required access authorizations.
CCI-002895	The organization designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
CCI-002896	The organization defines the information system components for which it obtains maintenance support and/or spare parts.
CCI-002897	The organization defines a time period for obtaining maintenance support and/or spare parts for organization-defined information system components after a failure.
CCI-002898	The organization performs preventive maintenance on organization-defined information system components at organization-defined time intervals.
CCI-002899	The organization defines information system components on which to perform preventive maintenance.
CCI-002900	The organization defines time intervals at which to perform preventive maintenance on organization-defined information system components.
CCI-002901	The organization performs predictive maintenance on organization-defined information system components at organization-defined intervals.
CCI-002902	The organization defines information system components on which to perform predictive maintenance.
CCI-002903	The organization defines time intervals at which to perform predictive maintenance on organization-defined information system components.
CCI-002904	The organization employs automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system.
CCI-002566	The organization defines personnel or roles to whom a documented media protection policy and procedures will be disseminated.
CCI-002567	The organization reviews and approves media sanitization.
CCI-002568	The organization tracks and documents media sanitization.
CCI-002569	The organization verifies media sanitization.
CCI-002570	The organization reviews and approves media disposal actions.
CCI-002571	The organization tracks and documents media disposal actions.
CCI-002572	The organization verifies media disposal actions.
CCI-002573	The organization enforces dual authorization for the sanitization of organization-defined information system media.
CCI-002574	The organization defines the information system media that dual authorization is enforced for sanitization.
CCI-002575	The organization defines information systems, system components, or devices from which information is to be purged/wiped, either remotely or under the organization-defined conditions.
CCI-002576	The organization defines conditions under which information from organization-defined information systems, system components, or devices should be purged/wiped.
CCI-002577	The organization provides the capability to purge/wipe information from organization-defined information systems, system components, or devices either remotely or under organization-defined conditions.
CCI-002578	The organization defines information system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures in accordance with applicable federal and organizational standards and policies.
CCI-002579	The organization defines the sanitization techniques and procedures to be used to sanitize organization-defined information system media prior to disposal, release out of organizational control, or release for reuse in accordance with applicable federal and organization standards and policies.
CCI-002580	The organization employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
CCI-002581	The organization defines the types of information system media to restrict or prohibit on organization-defined information systems or system components using organization-defined security safeguards.
CCI-002582	The organization defines the information systems or system components on which to restrict or prohibit the use of organization-defined types of information system media using organization-defined security safeguards.
CCI-002583	The organization defines the security safeguards to use for restricting or prohibiting the use of organization-defined types of information system media on organization-defined information systems or system components.
CCI-002584	The organization restricts or prohibits the use of organization-defined types of information system media on organization-defined information systems or system components using organization-defined security safeguards.
CCI-002585	The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.
CCI-002586	The organization prohibits the use of sanitization-resistant media in organizational information systems.
CCI-002587	The organization documents information system media downgrading actions.
CCI-002588	The organization employs organization-defined tests of downgrading equipment in accordance with organization-defined frequency.
CCI-002589	The organization employs procedures to verify correct performance of organization-defined tests of downgrading equipment in accordance with organization-defined frequency.
CCI-002590	The organization defines tests to employ for downgrading equipment.
CCI-002591	The organization defines the frequency with which to employ tests of downgrading equipment and procedures to verify correct performance.
CCI-002592	The organization defines Controlled Unclassified Information (CUI).
CCI-002593	The organization downgrades information system media containing organization-defined Controlled Unclassified Information (CUI) prior to public release in accordance with applicable federal and organizational standards and policies.
CCI-002594	The organization downgrades information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.
CCI-002595	The organization establishes an organization-defined information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.
CCI-002596	The organization establishes and defines an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.
CCI-002597	The organization defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.
CCI-002598	The organization ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.
CCI-002599	The organization defines and identifies the information system media requiring downgrading.
CCI-002600	The organization downgrades the identified information system media using the established process.
CCI-002908	The organization defines the personnel or roles to whom a physical and environmental protection policy is disseminated.
CCI-002909	The organization defines the personnel or roles to whom the physical and environmental protection procedures are disseminated.
CCI-002910	The organization approves a list of individuals with authorized access to the facility where the information system resides.
CCI-002911	The organization maintains a list of individuals with authorized access to the facility where the information system resides.
CCI-002912	The organization defines a list of acceptable forms of identification for visitor access to the facility where the information system resides.
CCI-002913	The organization restricts unescorted access to the facility where the information system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined credentials.
CCI-002914	The organization defines the credentials required for personnel to have unescorted access to the facility where the information system resides.
CCI-002915	The organization defines the entry/exit points to the facility where the information system resides.
CCI-002916	The organization defines the physical access control systems/devices or guards that control ingress/egress to the facility where the information system resides.
CCI-002917	The organization maintains physical access audit logs for organization-defined entry/exit points to the facility where the information system resides.
CCI-002918	The organization defines entry/exit points to the facility where the information system resides that require physical access audit logs be maintained.
CCI-002919	The organization provides organization-defined security safeguards to control access to areas within the facility where the information system resides officially designated as publicly accessible.
CCI-002920	The organization defines security safeguards to control access to areas within the facility where the information system resides officially designated as publicly accessible.
CCI-002921	The organization escorts visitors in the facility where the information system resides during organization-defined circumstances requiring visitor escorts.
CCI-002922	The organization defines circumstances requiring visitor escorts in the facility where the information system resides.
CCI-002923	The organization monitors visitor activity in the facility where the information system resides during organization-defined circumstances requiring visitor monitoring.
CCI-002924	The organization defines circumstances requiring visitor monitoring in the facility where the information system resides.
CCI-002925	The organization defines the physical access devices to inventory.
CCI-002926	The organization defines the physical spaces containing one or more components of the information system that require physical access authorizations and controls at the facility where the information system resides.
CCI-002927	The organization defines the frequency with which to perform security checks at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of information system components.
CCI-002928	The organization defines security safeguards to detect and prevent physical tampering or alteration of organization-defined hardware components within the information system.
CCI-002929	The organization defines hardware components within the information system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.
CCI-002930	The organization defines information system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security safeguards.
CCI-002931	The organization defines security safeguards to control physical access to organization-defined information system distribution and transmission lines within organizational facilities.
CCI-002932	The organization controls physical access to output from organization-defined output devices.
CCI-002933	The organization defines output devices for which physical access to output is controlled.
CCI-002934	The organization ensures that only authorized individuals receive output from organization-defined output devices.
CCI-002935	The information system controls physical access to output from organization-defined output devices.
CCI-002936	The information system links individual identity to receipt of output from organization-defined output devices.
CCI-002937	The organization marks organization-defined information system output devices indicating the appropriate security marking of the information permitted to be output from the device.
CCI-002938	The organization defines the information system output devices marked indicating the appropriate security marking of the information permitted to be output from the device.
CCI-002939	The organization monitors physical access to the facility where the information system resides to detect and respond to physical security incidents.
CCI-002940	The organization reviews physical access logs upon occurrence of organization-defined events or potential indications of events.
CCI-002941	The organization defines events or potential indications of events requiring review of physical access logs.
CCI-002942	The organization employs automated mechanisms to recognize organization-defined classes/types of intrusions.
CCI-002943	The organization defines classes/types of intrusions to recognize using automated mechanisms.
CCI-002944	The organization employs automated mechanisms to initiate organization-defined response actions to organization-defined classes/types of intrusions.
CCI-002945	The organization defines response actions to initiate when organization-defined classes/types of intrusions are recognized.
CCI-002946	The organization employs video surveillance of organization-defined operational areas.
CCI-002947	The organization defines the operational areas in which to employ video surveillance.
CCI-002948	The organization retains video surveillance recordings for an organization-defined time period.
CCI-002949	The organization defines the time period to retain video surveillance recordings.
CCI-002950	The organization monitors physical access to the information system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the information system.
CCI-002951	The organization defines physical spaces containing one or more components of the information system in which physical access is monitored.
CCI-002952	The organization defines the time period to maintain visitor access records to the facility where the information system resides.
CCI-002953	The organization employs redundant power cabling paths that are physically separated by an organization-defined distance.
CCI-002954	The organization defines the distance by which to physically separate redundant power cabling paths.
CCI-002955	The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system and/or transition of the information system to long-term alternate power in the event of a primary power source loss.
CCI-002956	The organization provides a long-term alternate power supply for the information system that is self-contained.
CCI-002957	The organization provides a long-term alternate power supply for the information system that is not reliant on external power generation.
CCI-002958	The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.
CCI-002959	The organization provides emergency lighting for all areas within the facility supporting essential missions.
CCI-002960	The organization provides emergency lighting for all areas within the facility supporting essential business functions.
CCI-002961	The organization employs fire detection devices/systems for the information system that activate automatically.
CCI-002962	The organization employs fire detection devices/systems for the information system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire.
CCI-002963	The organization defines the personnel or roles to be notified in the event of a fire.
CCI-002964	The organization defines the emergency responders to be notified in the event of a fire.
CCI-002965	The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to organization-defined personnel or roles and organization-defined emergency responders.
CCI-002966	The organization defines the personnel or roles to be automatically notified of any activation of fire suppression devices/systems for the information system.
CCI-002967	The organization defines the emergency responders to be automatically notified of any activation of fire suppression devices/systems for the information system.
CCI-002968	The organization ensures that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors.
CCI-002969	The organization defines a frequency with which the facility undergoes fire protection inspections.
CCI-002970	The organization resolves deficiencies identified during facility fire protection inspections within an organization-defined time period.
CCI-002971	The organization defines the time period within which to resolve deficiencies identified during facility fire protection inspections.
CCI-002972	The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts organization-defined personnel or roles.
CCI-002973	The organization defines the personnel or roles to be alerted when automated mechanisms detect the presence of water in the vicinity of the information system.
CCI-002974	The organization defines types of information system components to authorize, monitor, and control entering and exiting the facility and to maintain records.
CCI-002975	The organization defines security controls to employ at alternate work sites.
CCI-002976	The organization defines physical and environmental hazards that could cause potential damage to information system components within the facility.
CCI-002977	The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.
CCI-002978	The organization considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.
CCI-003047	The organization defines the personnel or roles to whom a security planning policy is disseminated.
CCI-003048	The organization defines the personnel or roles to whom the security planning procedures are disseminated.
CCI-003049	The organization develops a security plan for the information system.
CCI-003050	The organization^s security plan for the information system is consistent with the organization^s enterprise architecture.
CCI-003051	The organization^s security plan for the information system explicitly defines the authorization boundary for the system.
CCI-003052	The organization^s security plan for the information system describes the operational context of the information system in terms of missions and business processes.
CCI-003053	The organization^s security plan for the information system provides the security categorization of the information system, including supporting rationale.
CCI-003054	The organization^s security plan for the information system describes the operational environment for the information system and relationships with, or connections to, other information systems.
CCI-003055	The organization^s security plan for the information system provides an overview of the security requirements for the system.
CCI-003056	The organization^s security plan for the information system identifies any relevant overlays, if applicable.
CCI-003057	The organization^s security plan for the information system describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring decisions.
CCI-003058	The organization distributes copies of the security plan to organization-defined personnel or roles.
CCI-003059	The organization distributes copies of the security plan to organization-defined personnel or roles.
CCI-003060	The organization defines the personnel or roles to whom copies of the security plan are distributed.
CCI-003061	The organization communicates subsequent changes to the security plan to organization-defined personnel or roles.
CCI-003062	The organization defines the personnel or roles to whom changes to the security plan are communicated.
CCI-003063	The organization protects the security plan from unauthorized disclosure.
CCI-003064	The organization protects the security plan from unauthorized modification.
CCI-003065	The organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities.
CCI-003066	The organization defines the individuals or groups with whom security-related activities are planned and coordinated.
CCI-003067	The organization defines the individuals or groups with whom security-related activities are planned and coordinated.
CCI-003068	The organization reviews and updates the rules of behavior in accordance with organization-defined frequency.
CCI-003069	The organization defines the frequency with which to review and update the rules of behavior.
CCI-003070	The organization requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.
CCI-003071	The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum, how the organization intends to operate the system from the perspective of information security.
CCI-003072	The organization develops an information security architecture for the information system.
CCI-003073	The organization^s information security architecture for the information system describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information.
CCI-003074	The organization^s information security architecture for the information system describes how the information security architecture is integrated into and supports the enterprise architecture.
CCI-003075	The organization^s information security architecture for the information system describes any information security assumptions about, and dependencies on, external services.
CCI-003076	The organization reviews and updates the information security architecture in accordance with organization-defined frequency to reflect updates in the enterprise architecture.
CCI-003077	The organization defines the frequency with which to review and update the information system architecture.
CCI-003078	The organization ensures that planned information security architecture changes are reflected in the security plan.
CCI-003079	The organization ensures that planned information security architecture changes are reflected in the security Concept of Operations (CONOPS).
CCI-003080	The organization ensures that planned information security architecture changes are reflected in organizational procurements/acquisitions.
CCI-003081	The organization designs its security architecture using a defense-in-depth approach that allocates organization-defined security safeguards to organization-defined locations.
CCI-003082	The organization designs its security architecture using a defense-in-depth approach that allocates organization-defined security safeguards to organization-defined architectural layers.
CCI-003083	The organization defines the security safeguards to be allocated to organization-defined locations.
CCI-003084	The organization defines the security safeguards to be allocated to organization-defined architectural layers.
CCI-003085	The organization defines the locations to which it allocates organization-defined security safeguards in the security architecture.
CCI-003086	The organization defines the architectural layers to which it allocates organization-defined security safeguards in the security architecture.
CCI-003087	The organization designs its security architecture using a defense-in-depth approach that ensures that the allocated security safeguards operate in a coordinated and mutually reinforcing manner.
CCI-003088	The organization requires that organization-defined security safeguards allocated to organization-defined locations and architectural layers be obtained from different suppliers.
CCI-003017	The organization defines the personnel or roles to whom a personnel security policy is disseminated.
CCI-003018	The organization defines the personnel or roles to whom the personnel security procedures are disseminated.
CCI-003019	The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.
CCI-003020	The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria.
CCI-003021	The organization defines additional personnel screening criteria that individuals accessing an information system processing, storing, or transmitting information requiring protection must satisfy.
CCI-003016	The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period.
CCI-003022	The organization defines the time period within which to disable information system access upon termination of individual employment.
CCI-003023	The organization, upon termination of individual employment, terminates/revokes any authenticators/credentials associated with the individual.
CCI-003024	The organization defines information security topics to be discussed while conducting exit interviews.
CCI-003025	The organization defines personnel or roles to notify upon termination of individual employment.
CCI-003026	The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.
CCI-003027	The organization notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.
CCI-003028	The organization requires terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
CCI-003029	The organization employs automated mechanisms to notify organization-defined personnel or roles upon termination of an individual.
CCI-003030	The organization defines the personnel or roles to be notified by automated mechanism upon termination of an individual.
CCI-003031	The organization modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.
CCI-003032	The organization notifies organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.
CCI-003033	The organization defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.
CCI-003034	The organization defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.
CCI-003035	The organization develops and documents access agreements for organizational information systems.
CCI-003036	The organization ensures that individuals requiring access to organizational information and information systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.
CCI-003037	The organization defines the frequency for individuals requiring access to organization information and information systems to re-sign access agreements.
CCI-003038	The organization notifies individuals of applicable, legally binding post-employment requirements for protection of organizational information.
CCI-003039	The organization requires individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.
CCI-003040	The organization requires third-party providers to comply with personnel security policies and procedures established by the organization.
CCI-003041	The organization requires third-party providers to notify organization-defined personnel or roles of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within an organization-defined time period.
CCI-003042	The organization defines personnel or roles whom third-party providers are to notify when third-party personnel who possess organizational credentials and /or badges or who have information system privileges are transferred or terminated.
CCI-003043	The organization defines the time period for third-party providers to notify organization-defined personnel or roles when third-party personnel who possess organizational credentials and /or badges or who have information system privileges are transferred or terminated.
CCI-003044	The organization notifies organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
CCI-003045	The organization defines personnel or roles who are to be notified when a formal employee sanctions process is initiated.
CCI-003046	The organization defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated.
CCI-002368	The organization defines the personnel or roles to whom the risk assessment policy is disseminated.
CCI-002369	The organization defines the personnel or roles to whom the risk assessment procedures are disseminated.
CCI-002370	The organization disseminates risk assessment results to organization-defined personnel or roles.
CCI-002371	The organization defines the personnel or roles to whom the risk assessment results will be disseminated.
CCI-002372	The organization correlates the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.
CCI-002373	The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).
CCI-002374	The organization defines the corrective actions when information about the information system is discoverable by adversaries.
CCI-002375	The organization takes organization-defined corrective actions when information about the information system is discoverable by adversaries.
CCI-002376	The organization defines the personnel or roles with whom the information obtained from the vulnerability scanning process and security control assessments will be shared.
CCI-002906	The organization defines the vulnerability scanning activities in which the information system implements privileged access authorization to organization-identified information system components.
CCI-003119	The organization employs a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur.
CCI-003120	The organization defines the locations where technical surveillance countermeasures surveys are to be employed.
CCI-003121	The organization defines the frequency on which to employ technical surveillance countermeasures surveys.
CCI-003122	The organization defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.
CCI-003089	The organization defines the personnel or roles to whom the system and services acquisition policy is disseminated.
CCI-003090	The organization defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated.
CCI-003091	The organization determines information security requirements for the information system or information system service in mission/business process planning.
CCI-003092	The organization defines a system development life cycle that is used to manage the information system.
CCI-003093	The organization integrates the organizational information security risk management process into system development life cycle activities.
CCI-003094	The organization includes the security functional requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003095	The organization includes the security strength requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003096	The organization includes the security assurance requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003097	The organization includes the security-related documentation requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003098	The organization includes requirements for protecting security-related documentation, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003099	The organization includes description of the information system development environment and environment in which the system is intended to operate, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003100	The organization includes acceptance criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.
CCI-003101	The organization requires the developer of the information system, system component, or information system service to provide design information for the security controls to be employed that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail.
CCI-003102	The organization requires the developer of the information system, system component, or information system service to provide implementation information for the security controls to be employed that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail.
CCI-003103	The organization defines the design information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.
CCI-003104	The organization defines the implementation information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.
CCI-003105	The organization defines the level of detail for the design information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.
CCI-003106	The organization defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.
CCI-003107	The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.
CCI-003108	The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle.
CCI-003109	The organization requires the developer of the information system, system component, or information system service to deliver the system, component, or service with organization-defined security configurations implemented.
CCI-003110	The organization defines the security configurations required to be implemented when the developer delivers the information system, system component, or information system service.
CCI-003111	The organization requires the developer of the information system, system component, or information system service to use the organization-defined security configurations as the default for any subsequent system, component, or service reinstallation or upgrade.
CCI-003112	The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains an organization-defined level of detail.
CCI-003113	The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.
CCI-003114	The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.
CCI-003115	The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.
CCI-003116	The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.
CCI-003124	The organization obtains administrator documentation for the information system, system component, or information system service that describes secure configuration of the system, component, or service.
CCI-003125	The organization obtains administrator documentation for the information system, system component, or information system service that describes secure installation of the system, component, or service.
CCI-003126	The organization obtains administrator documentation for the information system, system component, or information system service that describes secure operation of the system, component, or service.
CCI-003127	The organization obtains administrator documentation for the information system, system component, or information system services that describes effective use and maintenance of security functions/mechanisms.
CCI-003128	The organization obtains administrator documentation for the information system, system component, or information system service that describes known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.
CCI-003129	The organization obtains user documentation for the information system, system component, or information system service that describes user-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms.
CCI-003130	The organization obtains user documentation for the information system, system component, or information system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.
CCI-003131	The organization obtains user documentation for the information system, system component, or information system service that describes user responsibilities in maintaining the security of the system, component, or service.
CCI-003132	The organization takes organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the information system, system component, or information system service.
CCI-003133	The organization defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the information system, system component, or information system service.
CCI-003134	The organization protects information system, system component, or information system service documentation as required, in accordance with the risk management strategy.
CCI-003135	The organization distributes information system, system component, or information system service documentation to organization-defined personnel or roles.
CCI-003136	The organization defines the personnel or roles to whom information system, system component, or information system service documentation is to be distributed.
CCI-003137	The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
CCI-003138	The organization employs organization-defined processes, methods, and techniques to monitor security control compliance by external service providers on an ongoing basis.
CCI-003139	The organization defines processes, methods, and techniques to employ to monitor security control compliance by external service providers on an ongoing basis.
CCI-003140	The organization conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services.
CCI-003141	The organization ensures that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles.
CCI-003142	The organization defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services.
CCI-003143	The organization requires providers of organization-defined external information system services to identify the functions, ports, protocols, and other services required for the use of such services.
CCI-003144	The organization defines the external information system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.
CCI-003145	The organization establishes trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.
CCI-003146	The organization documents trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.
CCI-003147	The organization maintains trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.
CCI-003148	The organization defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.
CCI-003149	The organization employs organization-defined security safeguards to ensure that the interests of organization-defined external service providers are consistent with and reflect organizational interests.
CCI-003150	The organization defines security safeguards to employ to ensure that the interests of organization-defined external service providers are consistent with and reflect organizational interests.
CCI-003151	The organization defines external service providers whose interests are consistent with and reflect organizational interests.
CCI-003152	The organization restricts the location of information processing, information/data, and/or information system services to organization-defined locations based on organization-defined requirements or conditions.
CCI-003153	The organization defines the locations for which to restrict information processing, information/data, and/or information system services based on organization-defined requirements or conditions.
CCI-003154	The organization defines the requirements or conditions on which to base restricting the location of information processing, information/data, and/or information system services to organization-defined locations.
CCI-003155	The organization requires the developer of the information system, system component, or information system service to perform configuration management during system, component, or service design, development, implementation and/or operation.
CCI-003156	The organization requires the developer of the information system, system component, or information system service to document the integrity of changes to organization-defined configuration items under configuration management.
CCI-003157	The organization requires the developer of the information system, system component, or information system service to manage the integrity of changes to organization-defined configuration items under configuration management.
CCI-003158	The organization requires the developer of the information system, system component, or information system service to control the integrity of changes to organization-defined configuration items under configuration management.
CCI-003159	The organization defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.
CCI-003160	The organization requires the developer of the information system, system component, or information system service to document the potential security impacts of approved changes to the system, component, or service.
CCI-003161	The organization requires the developer of the information system, system component, or information system service to track security flaws within the system, component, or service.
CCI-003162	The organization requires the developer of the information system, system component, or information system service to track flaw resolution within the system, component, or service.
CCI-003163	The organization requires the developer of the information system, system component, or information system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel.
CCI-003164	The organization defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported.
CCI-003165	The organization requires the developer of the information system, system component, or information system service to enable integrity verification of hardware components.
CCI-003166	The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.
CCI-003167	The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of software/firmware source code with previous versions.
CCI-003168	The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of object code with previous versions.
CCI-003169	The organization requires the developer of the information system, system component, or information system service to maintain the integrity of the mapping between the master build data (hardware drawings and software/firmware code) describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.
CCI-003170	The organization requires the developer of the information system, system component, or information system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.
CCI-003171	The organization requires the developer of the information system, system component, or information system service to create a security assessment plan.
CCI-003172	The organization requires the developer of the information system, system component, or information system service to implement a security assessment plan.
CCI-003173	The organization requires the developer of the information system, system component, or information system service to perform unit, integration, system, and/or regression testing/evaluation at an organization-defined depth and coverage.
CCI-003174	The organization defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation.
CCI-003175	The organization requires the developer of the information system, system component, or information system service to produce evidence of the execution of the security assessment plan.
CCI-003176	The organization requires the developer of the information system, system component, or information system service to produce the results of the security testing/evaluation.
CCI-003177	The organization requires the developer of the information system, system component, or information system service to implement a verifiable flaw remediation process.
CCI-003178	The organization requires the developer of the information system, system component, or information system service to correct flaws identified during security testing/evaluation.
CCI-003179	The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws.
CCI-003180	The organization requires the developer of the information system, system component, or information system service to document the results of static code analysis.
CCI-003181	The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analysis.
CCI-003182	The organization requires the developer of the information system, system component, or information system service to perform testing/evaluation of the as-built system, component, or service subsequent to threat and vulnerability analysis.
CCI-003183	The organization requires an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.
CCI-003184	The organization requires an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing/evaluation.
CCI-003185	The organization defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation.
CCI-003186	The organization ensures that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.
CCI-003187	The organization requires the developer of the information system, system component, or information system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.
CCI-003188	The organization defines the specific code for which the developer of the information system, system component, or information system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques.
CCI-003189	The organization defines the processes, procedures, and/or techniques to be used by the developer of the information system, system component, or information system service to perform a manual code review of organ