component.yaml

---
documentation_complete: false
name: Red Hat OpenShift Container Platform 4.x
schema_version: 3.0.0
satisfies:
##
## BEGINNING OF:
## ACCESS CONTROL
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: AC-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        AC-1(a) is an organizational control outside the scope of OpenShift configuration.
    - key: b
      text: |
        AC-1(b) is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        AC-2(a) is an organizational control outside the scope of OpenShift configuration.
    - key: b
      text: |
        AC-2(b) is an organizational control outside the scope of OpenShift configuration.
    - key: c
      text: |
        AC-2(c) is an organizational control outside the scope of OpenShift configuration.
    - key: d
      text: |
        AC-2(d) is an organizational control outside the scope of OpenShift configuration.
    - key: e
      text: |
        AC-2(e) is an organizational control outside the scope of OpenShift configuration.
    - key: f
      text: |
        AC-2(f) is an organizational control outside the scope of OpenShift configuration.
    - key: g
      text: |
        AC-2(g) is an organizational control outside the scope of OpenShift configuration.
    - key: h
      text: |
        AC-2(h) is an organizational control outside the scope of OpenShift configuration.
    - key: i
      text: |
        AC-2(i) is an organizational control outside the scope of OpenShift configuration.
    - key: j
      text: |
        AC-2(j) is an organizational control outside the scope of OpenShift configuration.
    - key: k
      text: |
        AC-2(k) is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        OpenShift components of the system support automated
        management through monitoring of accounts and system
        activity by logging of related information.

        While OpenShift can generate audit data, and securely
        transport the data to a SIEM, OpenShift does not provide
        automated mechanisms (e.g. email, text messages) after
        system events. This functionality would fall to third
        party software such as an Identity Provider (IdP),
        Active Directory (MSAD), LDAP, etc.

        To configure an IdP, see https://docs.openshift.com/container-platform/latest/authentication/identity_providers/configuring-ldap-identity-provider.html#configuring-ldap-identity-provider

# AC-2(2) NOTES:
#       The customer will be responsible for automatically removing or
#       disabling emergency and temporary accounts within the required
#       timeframe. A successful control response will need to address
#       all of the procedures and mechanisms involved in disabling these
#       accounts.
#
- control_key: AC-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        OpenShift does not have the capability to create
        guest/anonymous accounts or temporary accounts. Any
        external emergency or temporary accounts will be
        inherited from, and managed by, an external
        identity service (e.g. Active Directory, LDAP, etc.)

        To configure an IdP, see https://docs.openshift.com/container-platform/latest/authentication/identity_providers/configuring-ldap-identity-provider.html#configuring-ldap-identity-provider

#
# AC-2(3) NOTES:
#       The customer will be responsible for automatically disabling user
#       accounts after the specified period of inactivity. A successful
#       control response will need to address all automated mechanisms
#       involved in disabling inactive accounts.
#
# ADMIN NOTE:
#       AC-2(2) disables temp/emergency accounts after period of time.
#       AC-2(3) differs by disabling *every other* account type
#
- control_key: AC-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        OpenShift does not have the ability to automatically
        disable user accounts. Automatic disabling of these
        accounts must happen at the centralized account
        management level; for example, within LDAP, Red Hat
        IdM, or Active Directory.

        To configure an IdP, see https://docs.openshift.com/container-platform/latest/authentication/identity_providers/configuring-ldap-identity-provider.html#configuring-ldap-identity-provider

- control_key: AC-2 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        To meet FISMA requirements, OpenShift must be configured
        to use centralized authentication (e.g. LDAP, Red Hat IdM,
        Active Directory). The audit of account creation,
        modification, enabling, disabling, and removal actions is
        the responsibility of the centralized service. Additionally,
        notification of organization-defined personnel or roles is
        also the responsibility of the centralized authentication
        service.

##
## Ref: https://access.redhat.com/solutions/2191161
## "How to modify console session timeouts in Openshift 4"
##
- control_key: AC-2 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response for AC-2 (5) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-82

- control_key: AC-2 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        OpenShift implements dynamic privilege management capabilities through the use
        of a proper identity provider. OpenShift users can then be assigned roles through
        role bindings.

        To configure an IdP, see https://docs.openshift.com/container-platform/latest/authentication/identity_providers/configuring-ldap-identity-provider.html#configuring-ldap-identity-provider

- control_key: AC-2 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |-
        Establishing and administering privileged user accounts in accordance with a
        role-based access scheme that organizes allowed information system access and
        privileges into roles is an organizational control outside the scope of OpenShift

        However to facilitate a control response, using Role Based Access Control (RBAC),
        OpenShift roles can be used to grant various levels of access both cluster-wide as well as at
        the project scope. Users and groups can be associated with, or bound
        to, multiple roles at the same time.

        For service accounts that might also have privileged access, Security
        Context Constraints (SCC) should be used to limit privileged actions
        in service accounts.

        For the cluster, the kubeadmin user should be completely disabled.

        More information on RBAC can be viewed at:
        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

        More information for SCC can be viewed at:
        https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html
    - key: b
      text: |-
        The organization monitoring privileged role assignments is an organizational
        control outside the configuration of OpenShift.
    - key: c
      text: |-
        The organization taking defined actions when privileged role assignments are no
        longer appropriate is an organizational control outside the scope of OpenShift.

- control_key: AC-2 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        OpenShift will dynamically create user and system accounts in the OpenShift cluster
        when configured to connect to an identity provider.

        To configure an IdP, see https://docs.openshift.com/container-platform/latest/authentication/identity_providers/configuring-ldap-identity-provider.html#configuring-ldap-identity-provider

- control_key: AC-2 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control is applicable to the identity service provider
        and outside the scope of OpenShift configuration.

- control_key: AC-2 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        OpenShift does not have the concept of group accounts.

        Should the organization allow shared credentials, the
        creation and management of such would fall under the scope
        of operating the shared identity service and not OpenShift.

- control_key: AC-2 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
       Enforcement of organization-defined circumstances and/or usage
       conditions is the responsibility of third party identity
       management software such as Red Hat Identity Management (Red Hat IdM),
       Active Directory (MSAD), LDAP, etc.

       To configure an Identity Provider (IdP), refer to the "Authentication"
       chapter of the OpenShift Container Platform documentation at
       https://docs.openshift.com/container-platform/latest/authentication/understanding-authentication.html

- control_key: AC-2 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |-
        A control response for AC-2(12)(a) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-259
    - key: b
      text: |-
        A control response for AC-2(12)(b) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-259

- control_key: AC-2 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response for AC-2(13) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-211

- control_key: AC-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        This control is met through the use of Role-based Access Control
        for an OpenShift user. Namespaces should also be configured to
        sandbox users and resources to only the required projects.

- control_key: AC-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST, and incorporated into
        AC-6

- control_key: AC-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response for AC-3 (2) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-88

- control_key: AC-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |-
        A response to AC-3 (3) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-212
    - key: b
      text: |-
        A response to AC-3 (3) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-212
    - key: c
      text: |-
        A response to AC-3 (3) is planned. Engineering
        progress can be tracked via:

        https://issues.redhat.com/browse/CMP-212

- control_key: AC-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - key: a
      text: |-
        OpenShift uses the concept of users and groups to segregate subjects and objects.
        A user can be assigned to one or more groups, each of which represent a certain
        set of users. Groups are useful when managing authorization policies to grant
        permissions to multiple users at once, for example allowing access to objects
        within a project, versus granting them to users individually.

        OpenShift Security Context Constraints (SCC) control the actions that a pod can
        perform and what it has the ability to access.

        More information on Role Based Access Control (RBAC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

        More information on Security Context Constraints (SCC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html
    - key: b
      text: |-
        Only OpenShift cluster administrators have privileges to modify the security attributes
        within OpenShift. Specifically, cluster administrators have full access to modify the
        bindings of a particular role to a user. For users that have been provided more
        privileges based on a particular role, those users then can only make changes based on
        the privileges afforded to them.

        More information on Role Based Access Control (RBAC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

        More information on Security Context Constraints (SCC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html
    - key: c
      text: |-
        Only OpenShift cluster administrators have privileges to modify the security attributes
        within OpenShift. Specifically, cluster administrators have full access to modify the
        bindings of a particular role to a user. For users that have been provided more
        privileges based on a particular role, those users then can only make changes based on
        the privileges afforded to them. The same is true for Security Context Constraints (SCC).

        More information on Role Based Access Control (RBAC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

        More information on Security Context Constraints (SCC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html
    - key: d
      text: |-
        Only OpenShift cluster administrators have privileges to modify the full security attributes
        within OpenShift. Specifically, cluster administrators have full access to modify the default
        set of security attributes. For users that have been provided more
        privileges based on a particular role, those users then can only make changes based on
        the privileges afforded to them. The same is true for Security Context Constraints (SCC).

        More information on Role Based Access Control (RBAC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

        More information on Security Context Constraints (SCC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html
    - key: e
      text: |-
        Only OpenShift cluster administrators have privileges to change rules governing access
        control on the cluster. The same is true for Security Context Constraints (SCC).

        More information on Role Based Access Control (RBAC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

        More information on Security Context Constraints (SCC) can be viewed at:

        https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html

- control_key: AC-3 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A response to AC-3 (5) is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-91

- control_key: AC-3 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-3 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        This control is met through a variety of OpenShift technologies:
        - Role-based Access Control
        - Seccomp
        - SELinux
        - Namespaces
        - Security Context Constraints (SCC)

- control_key: AC-3 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A response to AC-3 (8) is planned. Engineering progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-96

- control_key: AC-3 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |-
        A response to AC-3 (9) is planned. Engineering progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-97
    - key: b
      text: |-
        A response to AC-3 (9) is planned. Engineering progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-97

- control_key: AC-3 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A response to AC-3 (10) is planned. Engineering progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-213

- control_key: AC-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-98

- control_key: AC-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-99

- control_key: AC-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-100

- control_key: AC-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-101

- control_key: AC-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-214

- control_key: AC-4 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-215

- control_key: AC-4 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-102

- control_key: AC-4 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-216

- control_key: AC-4 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-103

- control_key: AC-4 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        Changes to OpenShift information flows take effect immediately. It is assumed
        that all information flow modifications have undergone organizational
        approval processes prior to being implemented in OpenShift.

        OpenShift cannot protect against authenticated users who were
        given authorization to execute administrative commands (such as
        information flow modifications).

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-104

- control_key: AC-4 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        Privileged Administrators are defined as authenticated users who
        were given authorization to execute privileged commands on OpenShift
        systems (e.g. "sudo access").

        To modify security policies users must first authenticate with
        standard credentials (e.g. username/password or username/key).
        Once authenticated users must elevate privileges to root access
        through usage of "sudo", which will require users to re-authenticate
        themselves.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-217

- control_key: AC-4 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        Privileged Administrators are defined as authenticated users who
        were given authorization to execute privileged commands on OpenShift
        systems (e.g. "sudo access").

        The default system behavior allows Privileged Administrators
        to (re)configure security policy filters. For example,
        to reflect changes in network security policies, Privileged
        Administrators can dynamically change the allowed network
        ports and protocols that security policy mechanisms (such
        as firewalld) check in accordance with the definitions
        provided by organizations.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-218

- control_key: AC-4 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-105

- control_key: AC-4 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-106

- control_key: AC-4 (14)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-107

- control_key: AC-4 (15)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-108

- control_key: AC-4 (16)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-4 (17)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-107

- control_key: AC-4 (18)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-110

- control_key: AC-4 (19)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-111

- control_key: AC-4 (20)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-112

- control_key: AC-4 (21)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        The customer will be responsible for separating information flows
        within the customer application. A successful control response will
        need to address the customer organizational requirements for
        the separation of information flows, and the mechanisms and
        techniques used to accomplish this separation.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-113

- control_key: AC-4 (22)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-114

- control_key: AC-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Separation of duties is an organizational process outside the
        scope of OpenShift configuration.

        However, to aide in such processes, note that OpenShift provides the capability to
        implement Role-based Access Control (RBAC) which determine whether a
        user is allowed to perform a given action. Documentation on the OpenShift RBAC
        capabilities can be found at
        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html
    - key: b
      text: |
        Documentation of the separation of duties of individuals
        is an organizational control outside the scope of OpenShift
        configuration.

        However, to aide in such processes, note that OpenShift provides the capability to
        implement Role-based access control (RBAC) objects which determine whether a
        user is allowed to perform a given action. Documentation on the OpenShift RBAC
        capabilities can be found at
        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html
    - key: c
      text: |
        Organizational processes which define information system access
        authorizations to support separation of duties is outside
        the scope of OpenShift configuration.

        However, to aide in such processes, note that OpenShift provides the capability to
        implement Role-based access control (RBAC) objects which determine whether a
        user is allowed to perform a given action. Documentation on the OpenShift RBAC
        capabilities can be found at
        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

- control_key: AC-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-115

- control_key: AC-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-219

- control_key: AC-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        This is an organizational/procedural control outside the scope of
        OpenShift configuration.

        The customer will be responsible for requiring users to use the
        lowest level of access required to perform any given function. In
        terms of OpenShift, this may require creation of multiple logon
        accounts per user. When users require access to privileged functions
        or capability, they will need to logout from the unprivileged account
        and login with an account that has received appropriate RBAC rights.

        Note: OpenShift does not have privilege escalation capabilities similar
        to sudo in Linux. Users will have to completely logout/login when
        requiring privilege escalation between accounts.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-220

- control_key: AC-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-116

- control_key: AC-6 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-117

- control_key: AC-6 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-118

- control_key: AC-6 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-119

- control_key: AC-6 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-120
    - key: b
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-120

- control_key: AC-6 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-121

- control_key: AC-6 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for auditing the execution of
        privileged functions. A successful control response will need
        to relate this requirement to the general auditing requirements
        of the AU control family.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-122

- control_key: AC-6 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for ensuring that non-privileged
        users cannot execute privileged functions. A successful control
        response will need to discuss the use of centralized authentication
        and authorization and any other means of enforcement of privilege
        levels.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-123

- control_key: AC-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        The customer will be responsible for enforcing a limit on consecutive
        failed login attempts.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-124
    - key: b
      text: |
        The customer will be responsible for taking required
        actions defined by the customer, upon account lockout.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-124

- control_key: AC-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Management of mobile devices is outside the scope
        of OpenShift configuration.

- control_key: AC-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        The customer will be responsible for displaying a system use
        notification banner to users. A successful control response will need
        to address the conditions under which the banner will be displayed
        (if a non-government user accesses the system, the system use
        notification banner may not be appropriate), as well as the contents
        of the notification message.

        In context of OpenShift, a banner must be displayed for all means
        of accessing OpenShift itself (e.g. service consoles, remote access
        through SSH, etc).

        A control response to AC-8 is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-125
    - key: b
      text: |
        The customer will be responsible for displaying the use notification
        banner until the user acknowledges the usage condition and takes
        explicit actions to further access the system. A successful control
        response will need to address the means by which the user will indicate
        acknowledgement and move forward.

        A control response to AC-8 is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-125
    - key: c
      text: |
        The customer will be responsible for displaying a system use
        information message to users. A successful control response will need
        to address the conditions under which the message will be
        displayed (if a non-government user accesses the system, the system
        use information message may not be appropriate), as well as the
        contents of the notification message, including references to
        applicable monitoring, recording, or auditing, and authorized usage
        of the system.

        A control response to AC-8 is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-125
    - key: c.1
      text: |
        The customer will be responsible for determining the conditions
        under which the system use notification will be displayed. These
        conditions must be reviewed and accepted by the FedRAMP JAB.

        A control response to AC-8 is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-125
    - key: c.2
      text: |
        The customer will be responsible for how the system use notification
        will be verified and how often it should be re-displayed and
        re-verified. These conditions must be reviewed an accepted by the
        FedRAMP JAB.

        A control response to AC-8 is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-125
    - key: c.3
      text: |
        The customer will be responsible for verifying that the system use
        notification is being displayed as required, either through a
        configuration baseline check or via other means. If this verification
        does not happen through a configuration baseline check, the JAB must
        review and accept the process used to perform the verification.

        A control response to AC-8 is planned. Progress can be tracked
        via:

        https://issues.redhat.com/browse/CMP-125

- control_key: AC-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-126

- control_key: AC-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-127

- control_key: AC-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-128

- control_key: AC-9 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-129

- control_key: AC-9 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-130

- control_key: AC-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for limiting the number of
        concurrent sessions to the customer application as required.
        A successful control implemented will need to address the technical
        mechanism used to enforce this limit.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-131

- control_key: AC-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-222
    - key: b
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-222

- control_key: AC-11 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-221

- control_key: AC-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for defining events or conditions
        requiring disconnection (for example, user requesting logout), and for
        terminating the session when those events or conditions arise. A
        successful control response will need to outline the qualifying events
        or conditions.

        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-132

- control_key: AC-12 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-223
    - key: b
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-223

- control_key: AC-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Regardless of access mechanism, such as the OpenShift Console or remote
        access attempts through SSH, unauthenticated users will only be shown the
        system use notifications (as defined in AC-8) and login prompt. This is
        non-configurable behavior.

- control_key: AC-14 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Data release markings, such as NATO or NOFORN, are the responsibility
        of application and data owners running workload on the OpenShift platform.
        This control is not applicable to the configuration of OpenShift itself.
    - key: b
      text: |
        Data release markings, such as NATO or NOFORN, are the responsibility
        of application and data owners running workload on the OpenShift platform.
        This control is not applicable to the configuration of OpenShift itself.
    - key: c
      text: |
        Data release markings, such as NATO or NOFORN, are the responsibility
        of application and data owners running workload on the OpenShift platform.
        This control is not applicable to the configuration of OpenShift itself.
    - key: d
      text: |
        Data release markings, such as NATO or NOFORN, are the responsibility
        of application and data owners running workload on the OpenShift platform.
        This control is not applicable to the configuration of OpenShift itself.

- control_key: AC-16 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-16 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-17
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: AC-17 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of OpenShift configuration.

- control_key: AC-17 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        Beginning with OpenShift 4.3, when OpenShift is deployed on Red Hat Enterprise
        Linux, and FIPS is enabled as a kernel setting, OpenShift will use OpenSSL
        libraries instead of the native Golang crypto. The system operator will need to
        verify that OpenShift is being deployed on a version of Red Hat Enterprise Linux
        that has been FIPS validated.

        Prior to OpenShift 4.3, remote sessions were encrypted using Golang-provided
        cryptography. While not FIPS validated, this included the following
        cryptographic algorithms and ciphers to protect the confidentiality
        and integrity of remote access sessions:
                - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
                - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
                - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
                - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
                - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
                - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
                - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
                - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
                - TLS_RSA_WITH_AES_128_CBC_SHA
                - TLS_RSA_WITH_AES_256_CBC_SHA
                - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
                - TLS_RSA_WITH_3DES_EDE_CBC_SHA

        A better control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-144

- control_key: AC-17 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        The customer will be responsible for requiring remote access
        connections to the customer application to be routed through
        customer-defined network access control points. A successful control
        response will need to address the nature, number, and location of
        such access control points, as well as the security controls in place
        to protect those access control points.

        Managed access points can be created and configured through the use of
        bastion hosts, ingress rule(s), and/or opening a route to a new access point.

        Documentation for creating and using a bastion host can be viewed at:

        https://docs.openshift.com/container-platform/latest/networking/accessing-hosts.html

        Documentation for creating an ingress rule can be viewed at:

        https://docs.openshift.com/container-platform/latest/networking/configuring_ingress_cluster_traffic/overview-traffic.html

        Documentation for creating a route can be viewed at:

        https://docs.openshift.com/container-platform/latest/networking/routes/route-configuration.html

- control_key: AC-17 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Authorizing the execution of privileged commands and access to security-relevant
        information via remote access only for organizational defined needs is an
        organizational control outside the scope of OpenShift configuration.
    - key: b
      text: |
        Documenting the rationale for the execution of privileged commands and access to
        security-relevant information via remote access in the security plan for the
        information system is an organizational control outside the scope of OpenShift
        configuration.

- control_key: AC-17 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-17 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-147

- control_key: AC-17 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-17 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-17 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        OpenShift utilizes the firewall technology embedded into Red Hat
        Enterprise Linux. This technology, named firewalld, allows a system
        administrator to configure host-based rules which take effect
        immediately. This gives an OpenShift operator the ability to immediately
        drop all remote connections.

        Additionally, OpenShift nodes may be placed into Maintenance Mode. This
        designation will migrate applications from a given cluster node to
        another, disconnecting any active sessions to a given cluster node.

        If immediate disconnect of all hosted applications are desired,
        individual containers may be halted. This will disconnect user sessions
        for tenant applications immediately.

- control_key: AC-18
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes regarding the establishment of wireless
        access usage restrictions are outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes regarding wireless access to the information
        system are outside the scope of OpenShift configuration.

- control_key: AC-18 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Configuration of wireless networking is outside the scope of
        OpenShift configuration.

- control_key: AC-18 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-18 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The configuration of wireless networking is accomplished at the
        OpenShift node / operating system layer and is not applicable to
        the OpenShift Kubernetes layer.

- control_key: AC-18 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-149

- control_key: AC-18 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Radio antenna selection and calibration is outside the scope
        of OpenShift configuration.

- control_key: AC-19
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Establishing organizational usage restrictions for mobile devices is outside
        the scope of OpenShift configuration.
    - key: b
      text: |
        Authorization of mobile devices is outside the scope of OpenShift
        configuration.

- control_key: AC-19 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-19 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-19 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AC-19 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational restrictions on the use of mobile devices is outside
        the scope of OpenShift configuration.
    - key: b
      text: |
        Enforcement of organizational restrictions of mobile devices is
        outside the scope of OpenShift configuration.
    - key: c
      text: |
        Restricting the connection of classified mobile devices to
        classified information systems is outside the scope of OpenShift
        configuration.

- control_key: AC-19 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Encryption strategies for mobile devices is outside
        the scope of OpenShift configuration.

- control_key: AC-20
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes for establishing terms and conditions
        for accessing the information system from external information
        systems is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes for establishing terms and conditions
        for the processing, storage, or transmission of organization-controlled
        information using external information systems is outside the scope
        of OpenShift configuration.

- control_key: AC-20 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Verification of security control implementation on external systems
        is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Retention of approved information system connection or processing
        agreements with organizational entities hosting the external
        information system is outside the scope of OpenShift configuration.

- control_key: AC-20 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes regarding the restriction or
        prohibiting of the use of organization-controlled portable
        storage devices by authorized individuals on external information
        systems is outside the scope of OpenShift configuration.

- control_key: AC-20 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes regarding the restriction or
        prohibiting of the use of non-organizationally owned
        information systems, system components, or devices to process,
        store, or transmit organizational information, is
        outside the scope of OpenShift configuration.

- control_key: AC-20 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes regarding prohibiting the use of
        organization-defined network accessible storage devices in
        external information systems is beyond the scope of OpenShift
        configuration.

- control_key: AC-21
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Facilitation of information sharing is outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Employment of technology or processes to assist users in making
        information sharing/collaboration decisions is outside
        the scope of OpenShift configuration.

- control_key: AC-21 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Enforcement of information-sharing decisions is outside
        the scope of OpenShift configuration.

- control_key: AC-21 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Implementation of information search and retrieval services
        that enforce organization-defined information sharing restrictions
        is outside the scope of OpenShift configuration.

- control_key: AC-22
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes regarding the designation of individuals
        authorized to post information onto a publicly accessible information
        system is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Training authorized individuals to ensure that publicly accessible
        information does not contain nonpublic information is outside the
        scope of OpenShift configuration.
    - key: c
      text: |
        Reviewing the proposed content of information prior to posting onto
        the publicly accessible information system to ensure that nonpublic
        information is not included is outside the scope of OpenShift
        configuration.
    - key: d
      text: |
        Reviewing content on the publicly accessible information system
        for nonpublic information at an organization-defined frequency and
        removal of such information, if discovered, is outside the scope of
        OpenShift configuration.

- control_key: AC-23
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational employment of organization-defined data mining
        prevention and detection techniques for organization-defined data
        storage objects is outside the scope of OpenShift configuration.

- control_key: AC-24
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-151

- control_key: AC-24 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-152

- control_key: AC-24 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-153

- control_key: AC-25
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-154
##
## BEGINNING OF:
## AWARENESS AND TRAINING CONTROLS
##

- control_key: AT-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: AT-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into PM-15.
##
## BEGINNING OF:
## AUDIT AND ACCOUNTABILITY
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: AU-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Developing an organization-level audit and accountability
        policy is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Review and updating an organizational-level audit and
        accountability policy is outside the scope of OpenShift
        configuration.

- control_key: AU-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-155
    - key: b
      text: |
        Coordinating the security audit function with other
        organizational entities is outside the scope of
        system configuration.
    - key: c
      text: |
        For rationale regarding why the auditable events are deemed to be
        adequate to support after-the-fact investigations of security incidents,
        please contact your countries Common Criteria representative:
        https://www.commoncriteriaportal.org/ccra/members/
    - key: d
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-155

- control_key: AU-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AU-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AU-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational review and updates to the audited events are
        outside the scope of OpenShift configuration.

- control_key: AU-2 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AU-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-156

- control_key: AU-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-157

- control_key: AU-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-158

- control_key: AU-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-159

- control_key: AU-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-160

- control_key: AU-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-161
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-161

- control_key: AU-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-162

- control_key: AU-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-163

- control_key: AU-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-164

- control_key: AU-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-165

- control_key: AU-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational review and analysis of information system
        audit records for indications of organization-defined
        inappropriate or unusual activity is outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Reporting findings of organization-defined inappropriate or
        unusual activity to organization-defined personnel or roles is
        outside the scope of OpenShift configuration.

- control_key: AU-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:
        https://issues.redhat.com/browse/CMP-167

- control_key: AU-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AU-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational analysis and correlation of audit records across
        different repositories to gain organization-wide
        situational awareness is outside the scope
        of OpenShift configuration.

        To aide in such organizational processes, note that OpenShift's
        Cluster Logging Operator enables OpenShift administrators to
        configure custom pipelines to send OpenShift cluster logs to remote
        log stores. These remote destinations, such as Elastic or
        Splunk endpoints, could be used for information system-wide correlation.

        Documentation regarding how to forward cluster logs using the
        Cluster Logging Operator to specific endpoints can be found at:

        https://docs.openshift.com/container-platform/latest/logging/cluster-logging.html

- control_key: AU-6 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational capability to centrally review and analyze
        audit records from multiple components within the system
        is outside the scope of OpenShift configuration.

        Note: When AU-4 (1) is enforced OpenShift will be configured
        to off-load audit records onto a different system
        or media than the system being audited. In practice this correlates
        to offloading audit records to a SIEM (e.g. Elastic). However,
        this control is specifically about centralized review and analysis,
        and not offloading records, thus AU-6 (4) is marked as not
        applicable.

- control_key: AU-6 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational capability to integrate analysis or audit
        records with analysis of additional organization-defined
        data/information collected from other sources to further
        enhance the ability to identify inappropriate or unusual
        activity is outside the scope of OpenShift configuration.

        To aide in such organizational processes, note that OpenShift's
        Cluster Logging Operator enables OpenShift administrators to
        configure custom pipelines to send OpenShift cluster logs to remote
        log stores. These remote log stores, such as Elastic
        or Splunk endpoints, could be used for information
        system-wide correlation.

        Documentation regarding how to forward cluster logs using the
        Cluster Logging Operator to specific endpoints can be found at:

        https://docs.openshift.com/container-platform/latest/logging/cluster-logging.html

- control_key: AU-6 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational capability to correlate information from
        OpenShift audit records with information obtained from monitoring
        physical access to further enhanced the ability to identify
        suspicious, inappropriate, unusual, or malevolent activity
        is outside the scope of OpenShift configuration.

        To aide in such organizational processes, note that OpenShift's
        Cluster Logging Operator enables OpenShift administrators to
        configure custom pipelines to aggregate all the logs to remote
        destinations. These remote destinations, such as Elastic
        or Splunk endpoints, could be used for information
        system-wide correlation.

        Documentation regarding how to forward cluster logs using the
        Cluster Logging Operator to specific endpoints can be found at:

        https://docs.openshift.com/container-platform/latest/logging/cluster-logging.html

- control_key: AU-6 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational specification of permitted actions for
        information system processes, roles, and/or users, associated
        with the review, analysis, and reporting of audit
        information is outside the scope of OpenShift configuration.

- control_key: AU-6 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes to perform full text analysis or audited
        privileged commands in a physically distinct component or subsystem
        of the information system, or other information system that is
        dedicated to that analysis, is outside the scope of OpenShift
        configuration.

- control_key: AU-6 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes to correlate information
        from nontechnical sources with audit information to enhance
        organization-wide situational awareness is outside
        the scope of OpenShift configuration.

- control_key: AU-6 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational adjustment of the level of audit review, analysis, and
        reporting within the information system when there is a change in risk
        based on law enforcement information, intelligence information, or other
        credible sources of information, is outside the scope of OpenShift
        configuration.

- control_key: AU-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - key: a
      text: |
        OpenShift supports an audit reduction and report generation capability that
        supports on-demand audit review, analysis, and reporting
        requirements and after-the-fact investigations of security incidents
        only when the OpenShift Cluster Logging Operator is configured to send
        logs to a remote log store such as Elastic or Splunk.
        It is then the responsibility of the 3rd party tools such as Elastic or Splunk
        to then provide the support and capability for audit review, analysis, and
        reporting requirements and after-the-fact investigations of security incidents.

        To configure cluster logging to aide in audit reduction, review, analysis, and
        reporting, the OpenShift Cluster Logging Operator can be configured via:

        https://docs.openshift.com/container-platform/latest/logging/cluster-logging-deploying.html
    - key: b
      text: |
        When OpenShift's Cluster Logging Operator sends OpenShift cluster logs to a remote log store,
        the operator does not alter the original content or time ordering of audit records.

- control_key: AU-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        OpenShift supports an audit reduction and report generation capability that
        supports on-demand audit review, analysis, and reporting
        requirements and after-the-fact investigations of security incidents
        only when the OpenShift Cluster Logging Operator is configured to send
        logs to a remote log store such as Elastic or Splunk.
        It is then the responsibility of the 3rd party tools such as Elastic or Splunk
        to then provide the support and capability for sort and search audit records
        for events of interest based on the content audit records.

        To configure cluster logging to aide in audit reduction, review, analysis, and
        reporting, the OpenShift Cluster Logging Operator can be configured via:

        https://docs.openshift.com/container-platform/latest/logging/cluster-logging-deploying.html

- control_key: AU-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-229

- control_key: AU-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - key: a
      text: |-
        By default, the OpenShift API uses the internal system clocks to generate
        time stamps for audit records. At the code level, the OpenShift API
        stores audit events in a struct called MicroTime:

        // MicroTime is version of Time with microsecond level precision.
        //
        // +protobuf.options.marshal=false
        // +protobuf.as=Timestamp
        // +protobuf.options.(gogoproto.goproto_stringer)=false
        type MicroTime struct
        { time.Time `protobuf:"-"` }

        which really is a time.Time value which comes from the standard golang library:

        https://golang.org/pkg/time/

    - key: b
      text: |-
        By default, the OpenShift API records time stamps for audit records
        that can be mapped to Coordinated Universal Time (UTC). For example
        in the following node audit record:

        {"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"ad209ce1-fec7-4130-8192-c4cc63f1d8cd","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-kube-controller-manager/configmaps/cert-recovery-controller-lock?timeout=35s","verb":"update","user":{"username":"system:serviceaccount:openshift-kube-controller-manager:localhost-recovery-client","uid":"dd4997e3-d565-4e37-80f8-7fc122ccd785","groups":["system:serviceaccounts","system:serviceaccounts:openshift-kube-controller-manager","system:authenticated"]},"sourceIPs":["::1"],"userAgent":"cluster-kube-controller-manager-operator/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"configmaps","namespace":"openshift-kube-controller-manager","name":"cert-recovery-controller-lock","uid":"5c57190b-6993-425d-8101-8337e48c7548","apiVersion":"v1","resourceVersion":"574307"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2020-04-02T08:27:20.200962Z","stageTimestamp":"2020-04-02T08:27:20.206710Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:openshift:operator:kube-controller-manager-recovery\" of ClusterRole \"cluster-admin\" to ServiceAccount \"localhost-recovery-client/openshift-kube-controller-manager\""}}

        timestamps such as requestReceivedTimestamp and stageTimestamp are
        in UTC format e.g. 2020-04-02T08:27:20.200962Z

        See https://docs.openshift.com/container-platform/latest/nodes/nodes/nodes-nodes-audit-log.html
        for more example of audit records.

- control_key: AU-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        OpenShift synchronizes time by utilizing the time services of the underyling operating
        operating system. This control is not applicable to OpenShift.
    - key: b
      text: |
        OpenShift synchronizes time by utilizing the time services of the underyling operating
        operating system. This control is not applicable to OpenShift.

- control_key: AU-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A complete control response is planned. Progress can be tracked
        via:

        https://github.com/ComplianceAsCode/redhat/issues/859

- control_key: AU-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-232

- control_key: AU-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Writing audit trails to hardware enforced, write-once media,
        is outside the scope of OpenShift configuration.

- control_key: AU-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Backup of audit records onto a physically different system or
        system component than the component being audited is the
        responsibility of the centralized audit facility defined in
        AU-4 (1), "Transfer to Alternate Storage," and outside
        the scope of OpenShift configuration.

- control_key: AU-9 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-236

- control_key: AU-9 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A complete control response is planned. Progress can be tracked
        via:

        https://github.com/ComplianceAsCode/redhat/issues/863

- control_key: AU-9 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        Per AU-4 (1), OpenShift will be configured to offload audit records
        to a centralized audit facility. Enforcement of dual authorization
        for movement and/or deletion of organization-defined audit
        information is the responsibility of the centralized audit
        facility, and outside the scope of OpenShift configuration.

- control_key: AU-9 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-237

- control_key: AU-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-232

- control_key: AU-10 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-239
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-239

- control_key: AU-10 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-240
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-240

- control_key: AU-10 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-241

- control_key: AU-10 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-242
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-242

- control_key: AU-10 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: AU-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-243

- control_key: AU-11 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-244

- control_key: AU-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-245
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-245
    - key: c
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-245

- control_key: AU-12 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-181

- control_key: AU-12 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-246

- control_key: AU-12 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-247

- control_key: AU-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Monitoring of organization-defined open source information
        and/or information sites at an organization-defined frequency for
        evidence of unauthorized disclosure of organizational information
        is outside the scope of OpenShift configuration.

- control_key: AU-13 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employment of automated mechanisms to determine if
        organizational information has been disclosed in an
        unauthorized manner is outside the scope of
        OpenShift configuration.

- control_key: AU-13 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Reviews of the open source information sites being monitored
        at an organization-defined frequency is outside the scope
        of OpenShift configuration.

- control_key: AU-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-248

- control_key: AU-14 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-249

- control_key: AU-14 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A complete control response is planned. Progress can be tracked
        via:

        https://github.com/ComplianceAsCode/redhat/issues/878

- control_key: AU-14 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-250

- control_key: AU-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-251

- control_key: AU-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employment of organization-defined methods for coordinating
        organization-defined audit information among external
        organizations when audit information is transmitted
        across organizational boundaries is outside the scope
        of OpenShift configuration.

- control_key: AU-16 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-2252

- control_key: AU-16 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Providing cross-organizational audit information to
        organization-defined organizations based on
        organization-defined cross-organizational sharing
        agreements is outside the scope of OpenShift
        configuration.
##
## BEGINNING OF:
## SECURITY ASSESSMENT AND AUTHORIZATION
##

- control_key: CA-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Establishing organizational security assessment and
        authorization policy and procedures is outside
        the scope of OpenShift configuration guidance.
    - key: b
      text: |
        Establishing organizational security assessment and
        authorization policy and procedures is outside
        the scope of OpenShift configuration guidance.

- control_key: CA-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Development of an organizational security assessment plan
        is outside the scope of OpenShift configuration guidance.
    - key: b
      text: |
        Development of an organizational security assessment plan
        is outside the scope of OpenShift configuration guidance.
    - key: c
      text: |
        Development of an organizational security assessment plan
        is outside the scope of OpenShift configuration guidance.
    - key: d
      text: |
        Development of an organizational security assessment plan
        is outside the scope of OpenShift configuration guidance.

- control_key: CA-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employment of independent assessors or assessment teams
        is outside the scope of OpenShift configuration guidance.

- control_key: CA-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Specialized security assessments are outside the scope
        of OpenShift configuration guidance.

- control_key: CA-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational acceptance of the results of an assessment
        is outside the scope of OpenShift configuration.

- control_key: CA-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Establishment of organizational system interconnection
        agreements is outside the scope of OpenShift configuration
        guidance.
    - key: b
      text: |
        Establishment of organizational system interconnection
        agreements is outside the scope of OpenShift configuration
        guidance.
    - key: c
      text: |
        Establishment of organizational system interconnection
        agreements is outside the scope of OpenShift configuration
        guidance.

- control_key: CA-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of
        OpenShift configuration guidance.

- control_key: CA-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of
        OpenShift configuration guidance.

- control_key: CA-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of
        OpenShift configuration guidance.

- control_key: CA-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This is an organizational control outside the scope of
        OpenShift configuration guidance.

- control_key: CA-3 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        This control is applicable to OpenShift and applicable
        through host-level firewall rules.

        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-253

- control_key: CA-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CA-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Creating an information system-level Plan of Action
        and Milestones (POA&M) is outside the scope of OpenShift
        configuration processes.

        However, to aid in remediating or
        mitigating any known weaknesses or deficiencies in
        OpenShift, Red Hat is planning to make public a POA&M specific
        to OpenShift. This is currently in progress. If you would like to
        monitor or collaborate in the creation of the OpenShift POA&M,
        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-254
    - key: b
      text: |
        Organizational processes relating to updating and the maintenance
        of an information system-level Plan of Action and Milestones (POA&M)
        is outside the scope of OpenShift configuration processes.

        However, Red Hat will be evaluating the self-assessment POA&M items specific
        to OpenShift. Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-254

- control_key: CA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Updates and maintenance of an information system-level
        Plan of Action and Milestones (POA&M) document outside the
        scope of OpenShift configuration.

- control_key: CA-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: b
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: c
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CA-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        The development and implementation of a continuous monitoring program
        that includes the establishment of organization-defined metrics to be
        monitored is an organizational control outside the scope of OpenShift
        configuration.
    - key: b
      text: |
        The development and implementation of a continuous monitoring program
        that includes the establishment of organization-defined frequencies for
        monitoring and assessment of such monitoring is an organizational control
        outside the scope of OpenShift configuration.
    - key: c
      text: |
        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-255
    - key: d
      text: |
        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-255
    - key: e
      text: |
        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-255
    - key: f
      text: |
        Response actions to address results of the analysis of security-related
        information is an organizational control outside the scope of OpenShift
        configuration.
    - key: g
      text: |
        Reporting the security status of organization and the information system
        to organization-defined personnel or roles at a specified organization-defined
        frequency is outside the scope of OpenShift configuration.

- control_key: CA-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employment of assessors or assessment teams is outside the
        scope of OpenShift configuration guidance.

- control_key: CA-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CA-7 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational trend analyses processes are
        outside the scope of OpenShift configuration guidance.

- control_key: CA-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Penetration testing is outside the scope of
        OpenShift configuration guidance.

- control_key: CA-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employment of independent penetration testers
        is out of scope for OpenShift configuration
        guidance.

- control_key: CA-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Red Team Exercises are out of scope for
        OpenShift configuration guidance.

- control_key: CA-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - key: a
      text: |
        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-256
    - key: b
      text: |
        Engineering progress can be tracked at:

        https://issues.redhat.com/browse/CMP-256

- control_key: CA-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        Internal discussion are ongoing on how to implement this control.
##
## BEGINNING OF:
## CONFIGURATION MANAGEMENT
##

# ADMINISTRATORS NOTE ON CM-2:
#       Implementation of this control varies greatly between customers. Some
#       want centralized config management, while others expect component
#       administrators to handle this (e.g. maintain custom Ansible scripts).
#       In Red Hat's OpenControl content CM-2 is handled at the PMO level,
#       however it's best to double check with the Information System owner
#       on expectations (component vs central CM).
#

- control_key: CM-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Developing, documenting, and disseminating an organizational configuration
        management policy is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Review and update procedures to the organizational configuration
        management policy is outside the scope of OpenShift configuration.

- control_key: CM-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The recommended approach for configuration management in the OpenShift Container
        platform is to implement the principles and patterns of GitOps

        GitOps uses Git pull requests to manage infrastructure and application configurations.
        The Git repository is considered the only source of truth and contains the
        entire state of the system so that the trail of changes to the system state are
        visible and auditable.

        Operators are a method of packaging, deploying, and managing a Kubernetes
        application. Watching over the OpenShift environment, using its current
        state to make decisions in real time. The Machine Config Operator (MCO)
        manages updates and configuration changes to essentially everything between
        the kernel and kubelet.

        For additional information:
        https://docs.openshift.com/container-platform/latest/architecture/cicd_gitops.html
        https://docs.openshift.com/container-platform/latest/operators/olm-what-operators-are.html

        Red Hat Advanced Cluster Management for Kubernetes (RHACM) is the preferred way of implementing
        and managing GitOps for OpenShift clusters. For more information on creating and managing
        channels for GitOps approaches using RHACM, see:

        https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.0/html-single/manage_applications/index#creating-and-managing-channels

- control_key: CM-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        The organization reviewing and updating the baseline configuration of
        OpenShift per an organization-defined frequency is outside the scope of
        OpenShift configuration.

        However to assist in formulating a control response,
        GitOps uses Git pull requests to manage infrastructure and application configurations.
        The Git repository is considered the only source of truth and contains the
        entire state of the system so that the trail of changes to the system state are
        visible and auditable. For more on using Git and GitOps see:

        https://docs.openshift.com/container-platform/latest/architecture/cicd_gitops.html

        Red Hat Advanced Cluster Management for Kubernetes (RHACM) is the preferred way of implementing
        and managing GitOps for OpenShift clusters. For more information on creating and managing
        channels for GitOps approaches using RHACM, see:

        https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.0/html-single/manage_applications/index#creating-and-managing-channels

    - key: b
      text: |
        The organization reviewing and updating the baseline configuration of
        OpenShift when required due to organization-defined circumstances is outside the scope of
        OpenShift configuration.

        However to assist in formulating a control response, GitOps uses Git pull requests to manage infrastructure and application configurations.
        The Git repository is considered the only source of truth and contains the
        entire state of the system so that the trail of changes to the system state are
        visible and auditable. For more on using Git and GitOps see:

        https://docs.openshift.com/container-platform/latest/architecture/cicd_gitops.html

        Red Hat Advanced Cluster Management for Kubernetes (RHACM) is the preferred way of implementing
        and managing GitOps for OpenShift clusters. For more information on creating and managing
        channels for GitOps approaches using RHACM, see:

        https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.0/html-single/manage_applications/index#creating-and-managing-channels

    - key: c
      text: |
        The organization reviewing and updating the baseline configuration of
        OpenShift as an integral part of OpenShift component installations and upgrades
        is outside the scope of OpenShift configuration.

        However to assist in formulating a control response,  GitOps uses Git pull requests
        to manage infrastructure and application configurations.
        The Git repository is considered the only source of truth and contains the
        entire state of the system so that the trail of changes to the system state are
        visible and auditable. For more on using Git and GitOps see:

        https://docs.openshift.com/container-platform/latest/architecture/cicd_gitops.html

        Red Hat Advanced Cluster Management for Kubernetes (RHACM) is the preferred way of implementing
        and managing GitOps for OpenShift clusters. For more information on creating and managing
        channels for GitOps approaches using RHACM, see:

        https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.0/html-single/manage_applications/index#creating-and-managing-channels



- control_key: CM-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-262

- control_key: CM-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The organization retaining an organization-defined number of previous versions of baseline
        configurations of the information system to support rollback is an organizational control
        outside the scope of OpenShift configuration.

        However to assist in formulating a control response, GitOps uses Git pull requests
        to manage infrastructure and application configurations.
        The Git repository is considered the only source of truth and contains the
        entire state of the system so that the trail of changes to the system state are
        visible and auditable. For more on using Git and GitOps see:

        https://docs.openshift.com/container-platform/latest/architecture/cicd_gitops.html

        Red Hat Advanced Cluster Management for Kubernetes (RHACM) is the preferred way of implementing
        and managing GitOps for OpenShift clusters. For more information on creating and managing
        channels for GitOps approaches using RHACM, see:

        https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.0/html-single/manage_applications/index#creating-and-managing-channels


- control_key: CM-2 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CM-2 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CM-2 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-264

- control_key: CM-2 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational issuance of organization-defined information
        systems, system components, or devices with organizational-defined
        configurations to individuals traveling to locations that the
        organization deems to be of significant risk is outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Organizational processes to apply organization-defined security
        safeguards to the devices when the individuals return is
        outside the scope of OpenShift configuration.

- control_key: CM-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-265
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-265
    - key: c
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-265
    - key: d
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-265
    - key: e
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-265
    - key: f
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-265
    - key: g
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.


- control_key: CM-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: b
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: c
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: d
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: e
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: f
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-266

- control_key: CM-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The requirement for an information security representative to be
        a member of the organization-defined configuration change
        control element is outside the scope of OpenShift configuration.

- control_key: CM-3 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-267

- control_key: CM-3 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-268

- control_key: CM-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational analysis of changes to the information system to
        determine potential security impacts prior to change implementation
        is outside the scope of OpenShift configuration.

- control_key: CM-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-269

- control_key: CM-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Verification of security function implementation and status is an organizational
        policy and procedure control. This functionality is outside the scope of OpenShift
        configuration.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-270

- control_key: CM-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Defining, documenting, approving, and enforcing physical and logical access restrictions
        associated with changes to the information system is an organizational control outside
        the scope of OpenShift configuration.

        However to assist in developing policies/procedures to address this control, use of Role-based
        Access Control (RBAC) and the architecture of OpenShift provide logical access restrictions
        based on user and group roles in addition to logical separation of systems and components.

        See the following for more information on RBAC and OpenShift architecture:

        https://docs.openshift.com/container-platform/latest/architecture/architecture.html
        https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html

- control_key: CM-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://github.com/ComplianceAsCode/redhat/issues/897

- control_key: CM-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-187

- control_key: CM-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-271

- control_key: CM-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - key: a
      text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://github.com/ComplianceAsCode/redhat/issues/901
    - key: b
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-5 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-5 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CM-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-188
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-188
    - key: c
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-188
    - key: d
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-188

- control_key: CM-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-272

- control_key: CM-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CM-6 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CM-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-273
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-273

- control_key: CM-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-274
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-274

- control_key: CM-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-275

- control_key: CM-7 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-276

- control_key: CM-7 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-204
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-204
    - key: c
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-204

- control_key: CM-7 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-205
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-205
    - key: c
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-205

#       ADMINISTRATORS NOTE ON CM-8:
#       Implementation of this control varies between customers. Some agencies
#       maintain an inventory that state "OpenShift 4.x," whereas others want
#       named RPMs installed on the OpenShift components. The vast majority
#       follow the "OpenShift 4.x" listings. For those that do not, and want
#       complete listings of underlying RPMs, the following section should be
#       uncommented and updated.
#
#       If Satellite is managing the OpenShift nodes, documenting how OpenShift
#       components integrate into Satellite for centralized inventory management
#       is perfectly acceptable.
#
- control_key: CM-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-277
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-277

- control_key: CM-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The organization is responsible for updating the inventory of information
        system components as an integral part of component installations, removals,
        and information system updates.

        During an install, update, or removal, the OpenShift cluster will roll out updates
        for the system software inventory including the CoreOS nodes. More about updating
        to help with creating procedures and processes related to this control can be viewed
        at:

        https://docs.openshift.com/container-platform/latest/updating/updating-cluster-between-minor.html

- control_key: CM-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-279

- control_key: CM-8 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-280
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-280

- control_key: CM-8 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes to include in the information system
        component inventory information, a means for identifying
        by name, position, and/or role, individuals responsible/accountable
        for administering those components, is outside the scope
        of OpenShift configuration.

- control_key: CM-8 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational verification that all components within the
        authorization boundary of the information system are not
        duplicated in other information system component
        inventories is outside the scope of OpenShift configuration.

- control_key: CM-8 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-282

- control_key: CM-8 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-283

- control_key: CM-8 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-8 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational assignment of organization-defined acquired information
        system components to an information system is outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Organizational processes to receive an acknowledgement from the
        information system owner of the assignment in CM-8(8)(a) is outside
        the scope of OpenShift configuration.

- control_key: CM-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: b
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: c
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.
    - key: d
      text: |
        This control reflects organizational processes outside the scope
        of OpenShift configuration guidance.

- control_key: CM-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes to assign responsibility for developing the
        configuration management process to organizational personnel that are
        not directly involved in information system development are outside
        the scope of OpenShift configuration.

- control_key: CM-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Ensuring that the organization uses software and associated
        documentation in accordance with contract agreements and copyright laws
        is the complete responsibility of the organization. Red Hat's
        responsibilities to assist with the tracking of software licensing and
        usage of software provided by Red Hat will be fulfilled in accordance
        with all applicable contracts and agreements established for the
        project with the organization.
    - key: b
      text: |
        Tracking the use of software and associated documentation protected by
        quantity licenses to control copying and distribution is an
        organizational control outside the scope of OpenShift.

        However to assist Systems Administrators and Security personnel in
        tracking OpenShift subscriptions, the OpenShift Cluster Manager (OCM)
        service acts as a bridge to Red Hat Subscription Manager. A cluster
        connected to the internet can send telemetry to OpenShift Cluster
        Manager at https://cloud.redhat.com/openshift/, which then handles
        integration with Red Hat Subscription Manager to track subscriptions
        for OpenShift clusters.

        For disconnected clusters, there is no way to send telemetry data to
        OpenShift Cluster Manager. In this case, the organization must manually
        register their disconnected clusters with OpenShift Cluster Manager
        following the instructions at https://access.redhat.com/solutions/4930131
    - key: c
      text: |
        Controlling and documenting the use of peer-to-peer file sharing
        technology to ensure that this capability is not used for the
        unauthorized distribution, display, performance, or reproduction
        of copyrighted work is an organizational control outside the scope
        of OpenShift configuration.

- control_key: CM-10 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Establishment of organizational restrictions on open source software
        is outside the scope of OpenShift configuration.

# ADMINISTRATORS NOTE ON CM-11:
#       This would be a good place to demarcate installation of software
#       on the OSE nodes vs installation of software in trusted registries.
#
- control_key: CM-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-285
    - key: b
      text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-285
    - key: c
      text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-285

- control_key: CM-11 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-286

- control_key: CM-11 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        A complete control response is planned. Progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-287
##
## BEGINNING OF:
## CONTINGENCY PLANNING
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: CP-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Developing an organization-level contingency planning policy is
        outside the scope of OpenShift configuration.
    - key: b
      text: |
        Review and updating an organizational-level contingency planning
        policy is outside the scope of OpenShift configuration.

- control_key: CP-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Developing an organization-level contingency planning policy is
        outside the scope of OpenShift configuration.

        To facilitate a control response and assist in contingency planning,
        Backup and Restore of an Openshift cluster can be viewed at:

        https://docs.openshift.com/container-platform/latest/backup_and_restore/disaster_recovery/about-disaster-recovery.html

    - key: b
      text: |
        Distribution of an organizational-level contingency planning
        policy is outside the scope of OpenShift configuration.
    - key: c
      text: |
        Coordinating contingency planning activities with incident handling
        activities is outside the scope of OpenShift configuration.
    - key: d
      text: |
        Reviewing organizational contingency plans for the information system
        at an organization-defined frequency is outside the scope of
        OpenShift configuration.
    - key: e
      text: |
        Organizational processes to update the contingency plan are outside the
        scope of OpenShift configuration.
    - key: f
      text: |
        Organizational communication plans regarding the contingency plan are outside
        the scope of OpenShift configuration.
    - key: g
      text: |
        Protection of the contingency plan from unauthorized disclosure and
        modification is outside the scope of OpenShift configuration.

- control_key: CP-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Coordinating contingency plan development with organizational elements
        responsible for related plans is outside the scope of OpenShift
        configuration.

- control_key: CP-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Planning for the resumption of essential missions and business
        functions within an organization-defined time period of contingency
        plan activation is outside the scope of OpenShift configuration.

- control_key: CP-2 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Planning for the resumption of all missions and business
        functions within an organization-defined time period of contingency
        plan activation is outside the scope of OpenShift configuration.

- control_key: CP-2 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Planning for the continuance of essential missions and business
        functions with little or no loss of operational continuity and
        sustainment of that continuity until full information system
        restoration at primary processing and/or storage sites
        is outside the scope of OpenShift configuration.

- control_key: CP-2 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-2 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Coordination of organizational contingency plans with the
        contingency plans of external service providers to ensure that
        contingency requirements can be satisfied is outside the scope
        of OpenShift configuration.

- control_key: CP-2 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Providing contingency training to information system users consistent
        with assigned roles and responsibilities within an organization-defined
        time period of assuming a contingency role or responsibility is outside
        the scope of OpenShift configuration.
    - key: b
      text: |
        Providing contingency training to information system users consistent
        with assigned roles and responsibilities when required by information
        system changes is outside the scope of OpenShift configuration.
    - key: c
      text: |
        Providing contingency training to information system users consistent
        with assigned roles and responsibilities at an organization-defined
        frequency is outside the scope of OpenShift configuration.

- control_key: CP-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Incorporating simulated events into contingency training to
        facilitate effective response by personnel in crisis
        situations is outside the scope of OpenShift configuration.

- control_key: CP-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employment of automated mechanisms to provide a more thorough and
        realistic contingency training environment is outside the scope
        of OpenShift configuration.

- control_key: CP-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Testing the contingency plan for the information system at an
        organization-defined frequency using organization-defined tests
        to determine the effectiveness of the plan and the organizational
        readiness to execute the plan is outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational reviews of the contingency plan test results is outside
        the scope of OpenShift configuration.
    - key: c
      text: |
        Organizational process to initiate corrective actions, if needed,
        are outside the scope of OpenShift configuration.

- control_key: CP-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Coordinating contingency plan testing with organizational
        elements responsible for related plans is outside the scope
        of OpenShift configuration.

- control_key: CP-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational testing of the contingency plan at the alternate
        processing site to familiarize contingency personnel with the
        facility and available resources is outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational testing of the contingency plan at the alternate
        processing site to evaluate the capabilities of the alternate
        processing site to support contingency operations is outside
        the scope of OpenShift configuration.

- control_key: CP-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CP-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Establishment of an alternative storage site including
        necessary agreements to permit the storage and retrieval
        of information system backup information is outside
        the scope of OpenShift configuration.
    - key: b
      text: |
        Ensuring that the alternative storage site provides information
        security safeguards equivalent to that of the primary site
        is outside the scope of OpenShift configuration.

- control_key: CP-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Identification of an alternate storage site that is
        separated from the primary storage site to reduce
        susceptibility to the same threats is outside the scope
        of OpenShift configuration.

- control_key: CP-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Identification of potential accessibility problems to the alternate
        storage site in an event of an area-wide disruption or disaster and
        the outline of explicit mitigation actions is outside the scope
        of OpenShift configuration.

- control_key: CP-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        Ensuring that equipment and supplies required to transfer and resume
        operations are available at the alternate processing site or contracts
        are in place to support delivery to the site within the
        organization-defined time period for transfer/resumption is an
        organizational control outside the configuration of OpenShift.

        To assist Systems Administrators and Security personnel in answering
        this control in relation to OpenShift, Red Hat does not provide
        disaster recovery subscriptions for OpenShift. However, there are a
        couple of ways that a cluster can be configured to failover in the case
        of emergency or catastrophic failure. One way is to configure the
        cluster with geographically diverse set of nodes in different
        availability zones. See https://docs.openshift.com/container-platform/latest/machine_management/creating-infrastructure-machinesets.html for creating
        MachineSets for nodes to operate in different clouds.

        Alternatively, Red Hat Advanced Cluster Management for Kubernetes
        is a solution for multi-cluster deployment and management across
        different many differing operating environments. Red Hat Advanced
        Cluster Management for Kubernetes is considered a better tool to
        manage Kubernetes Clusters and to handle cluster failover in case of
        failure. Documentation can be viewed at:

        https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.0/html/about/welcome-to-red-hat-advanced-cluster-management-for-kubernetes
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Identification of an alternate processing site that is
        separated from the primary processing site to reduce
        susceptibility to the same threats is outside the
        scope of OpenShift configuration.

- control_key: CP-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Identification of potential accessibility problems to the
        alternate processing site in the event of an area-wide
        disruption or disaster and outline of explicit mitigation
        actions is outside the scope of OpenShift configuration.

- control_key: CP-7 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Development of alternate processing site agreements that contain
        priority-of-service provisions in accordance with organizational
        availability requirements (including recovery time objectives)
        is outside the scope of OpenShift configuration.

- control_key: CP-7 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-7 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CP-7 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational planning and preparation for circumstances
        that preclude returning to the primary processing site
        is outside the scope of OpenShift configuration.

- control_key: CP-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Establishment of alternate telecommunications services
        is outside the scope of OpenShift configuration.

- control_key: CP-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Development of primary and alternate telecommunications service
        agreements that contain priority-of-service provisions in accordance
        with organizational availability requirements (including recovery
        time objectives) is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Requests for Telecommunications Service Priority for all
        telecommunucations services used for national security emergency
        preparedness in the event that the primary and/or alternate
        telecommunications services are provided by a common carrier
        are outside the scope of OpenShift configuration.

- control_key: CP-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Obtaining alternate telecommunications services to reduce
        the likelihood of sharing a single point of failure with
        primary telecommunications services is outside the scope
        of OpenShift configuration.

- control_key: CP-8 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Obtaining alternate telecommunications services from providers
        that are separated from primary service providers to reduce
        susceptibility to the same threats is outside the scope
        of OpenShift configuration.

- control_key: CP-8 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Requiring primary and alternate telecommunications service
        providers to have contingency plans is outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Reviewing provider contingency plans to ensure that the plans
        meet organizational contingecny requirements is outside
        the scope of OpenShift configuration.
    - key: c
      text: |
        Obtaining evidence of contingency testing/training by providers
        at an organization-defined frequency is outside the plannedscope
        of OpenShift configuration.

- control_key: CP-8 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Testing alternate telecommunication services at
        an organization-defined frequency is outside the scope
        of OpenShift configuration.

- control_key: CP-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        The customer will be responsible for conducting daily incremental and
        weekly full backups of user-level information contained in the
        information system. Additional requirements and guidance include
        maintaining at least three backup copies of user-level information (at
        least one of which is available online) or provides an equivalent
        alternative. A successful control response will detail how backups of
        user-level information occurs, and how three backup copies are
        maintained.

        Conducting backups of user-level information to include the backups of
        a centralized identity provider is an organizational control outside the
        scope of OpenShift configuration. To assist System Administrators and
        organizations in their control response, documentation about backing
        up user-level information stored in etcd in OpenShift can be viewed at:

        https://docs.openshift.com/container-platform/latest/backup_and_restore/backing-up-etcd.html
    - key: b
      text: |
        The customer will be responsible for conducting daily incremental and
        weekly full backups of system-level information contained in the
        information system. Additional requirements and guidance include
        maintaining at least three backup copies of system-level information (at
        least one of which is available online) or provides an equivalent
        alternative. A successful control response will detail how backups of
        user-level information occurs, and how three backup copies are
        maintained.

        Conducting backups of system-level information is an organizational
        control outside the scope of OpenShift configuration. To assist System
        Administrators and organizations in their control response,
        documentation about disaster recovery procedures in OpenShift can be
        viewed at:

        https://docs.openshift.com/container-platform/latest/backup_and_restore/disaster_recovery/about-disaster-recovery.html
    - key: c
      text: |
        The customer will be responsible for conducting daily incremental and
        weekly full backups of information system documentation including
        security-related documentation.

        Conducting backups on information system and security-related documentation
        is an organizational control outside the scope of OpenShift configuration.
    - key: d
      text: |
        The customer will be responsible for protecting the confidentiality,
        integrity, and available of backup information at storage locations.
        Additional requirements and guidance include determining
        what elements of the cloud environment require the Information System
        Backup control. The customer will determine how Information System
        Backup is going to be verified and appropriate periodicity of the
        check.

        Protecting the confidentiality, integrity, and availability of backup
        information at separate storage locations an organizational control outside the
        scope of OpenShift configuration.

- control_key: CP-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The testing of backup information to verify media reliability
        and information integrity is an organizational control outside the scope
        of OpenShift configuration.

- control_key: CP-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-293

- control_key: CP-9 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Storing backup copies of organization-defined critical information
        system software and other security-related information in a separate
        facility or in a fire-rated container that is not collocated with the
        operational system is outside the scope of OpenShift configuration.

- control_key: CP-9 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CP-9 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-9 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-9 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for documenting how to reconstitute
        their OpenShift environment. A successful control response will detail
        processes used to fully recover/restore the OpenShift environment.

        To assist System Administrators and organizations in their control response,
        documentation about disaster recovery procedures in OpenShift can be
        viewed at:

        https://docs.openshift.com/container-platform/latest/backup_and_restore/disaster_recovery/about-disaster-recovery.html

- control_key: CP-10 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CP-10 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-10 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CP-10 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-10 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: CP-10 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: CP-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-296

- control_key: CP-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-297

- control_key: CP-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        Employment of organization-defined alternative or
        supplemental security mechanisms for satisfying
        organization-defined security functions when the primary
        means of implementing OpenShift security function is
        unavailable or compromised is outside the scope of
        OpenShift configuration guidance.

        A complete control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-298
##
## BEGINNING OF:
## IDENTIFICATION AND AUTHENTICATION
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: IA-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |-
        Developing organization-level identification and authentication
        policy and procedures are outside the scope of OpenShift configuration.
    - key: b
      text: |-
        Review and updating an organizational-level identification and authentication
        policy and procedures are outside the scope of OpenShift configuration.

- control_key: IA-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        Unique identification and authentication of organizational users
        is deferred to the organizational identity provider (such as
        LDAP, Active Directory, Red Hat SSO, etc). This part of the control
        is not applicable to OpenShift.

        To aid system administrators in configuring a centralized identity provider, documentation on
        supported authentication providers can be found in the
        OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-authentication.html

        The ability to uniquely identify processes acting on behalf of
        organizational users, such as when a user deploys a new
        container image, is provided by correlating system audit logs.

- control_key: IA-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Implementation of multifactor authentication for network
        access to privileged accounts is deferred to the
        organizational identity provider (such as
        LDAP, Active Directory, Red Hat SSO, etc).
        To aid system administrators, documentation on
        supported authentication providers can be found in the
        OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

        It is recommended to use separate accounts for privileged access. For example, at least one account for regular user
        access, and a separate account for cluster or project administrator access.
        The organization must determine how to best break up privileged accesses based off of organizational
        needs and requirements.

- control_key: IA-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Implementing multifactor authentication for network access
        to non-privileged accounts is the responsibility of the
        organizational identity provider (such as
        LDAP, Active Directory, Red Hat SSO, etc).

        To aid system administrators, documentation on
        supported authentication providers can be found in the
        OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        OpenShift has no concept of local accounts and was designed without the use of local accounts.
        OpenShift relies on a centralized identity provider rather than a local identity provider.
        The closest implementation concept of a local user account store would be the implementation
        of the htpasswd identity provider. However, use of this provider is not recommended for
        any reason for any security conscious environments or organizations.

        Because OpenShift has no concept of local accounts, the implementation of
        of multifactor authentication for local access to privileged accounts
        is not applicable to OpenShift.

- control_key: IA-2 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        OpenShift has no concept of local accounts and was designed without the use of local accounts.
        OpenShift relies on a centralized identity provider rather than a local identity provider.
        The closest implementation concept of a local user account store would be the implementation
        of the htpasswd identity provider. However, use of this provider is not recommended for
        any reason for any security conscious environments or organizations.

        Because OpenShift has no concept of local accounts, the implementation of
        of multifactor authentication for local access to non-privileged accounts
        is not applicable to OpenShift.

- control_key: IA-2 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-314

- control_key: IA-2 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-315

- control_key: IA-2 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-316

- control_key: IA-2 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-573

- control_key: IA-2 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-574

- control_key: IA-2 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A control response for IA-2(10) is planned.

- control_key: IA-2 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Implementing a separate device from the system
        gaining access to the information system using multifactor
        authentication for remote access to privileged and non-privileged
        accounts is an organizational control outside the configuration
        guidance of OpenShift.

- control_key: IA-2 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Acceptance and electronic verification of Personal
        Identity Verification (PIV) credentials is the responsibility
        of the organizational identity provider (such as
        LDAP, Active Directory, Red Hat SSO, etc).

        To aid system administrators, documentation on
        supported authentication providers can be found in the
        OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-2 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Implementing out-of-band authentication methods is an organizational
        control outside the configuration guidance of OpenShift.

- control_key: IA-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A control response for IA-3 is planned.

- control_key: IA-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-318

- control_key: IA-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: IA-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-319
    - key: b
      text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-319
- control_key: IA-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-320

- control_key: IA-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |-
        Receiving authorization from organization-defined personnel or roles to assign
        an individual, group, role, or device identifier is an organizational procedural
        requirement outside the scope of OpenShift configuration.
    - key: b
      text: |-
        Selecting an identifier that identifies an individual, group, role, or device
        is an organizational procedural requirement outside the scope of OpenShift
        configuration.

        To affectively manage information system identifiers in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: c
      text: |-
        Assigning the identifier to the intended individual, group, role, or device
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system identifiers in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: d
      text: |-
        Preventing reuse of identifiers for organization-defined time period is an organizational
        procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system identifiers in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: e
      text: |-
        Disabling the identifier after organization-defined time period of inactivity
        is an organizational procedural requirement outside the scope of OpenShift
        configuration.

        To affectively manage information system identifiers in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-323

- control_key: IA-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This is an organizational procedural requirement
        outside the scope of OpenShift configuration.

- control_key: IA-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This is an organizational procedural requirement
        outside the scope of OpenShift configuration.

- control_key: IA-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This is an organizational procedural requirement
        outside the scope of OpenShift configuration.

- control_key: IA-4 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-324

- control_key: IA-4 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Coordination with organization-defined external
        organizations for cross-organization management
        of identifiers is outside the scope of OpenShift
        configuration.

- control_key: IA-4 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Organizational requirements that the user registration
        process to receive an individual identifier be conducted
        in person before a designated registration authority
        is outside the scope of OpenShift configuration.

- control_key: IA-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |-
        Verifying, as part of the initial authenticator distribution, the identity
        of the individual, group, role, or device receiving the authenticator
        is an organizational procedural requirement
        outside the scope of OpenShift configuration.
    - key: b
      text: |-
        Establishing initial authenticator content for authenticators defined by the organization
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: c
      text: |-
        Ensuring that authenticators have sufficient strength of mechanism for their intended use
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: d
      text: |-
        Establishing and implementing administrative procedures for initial authenticator distribution,
        for lost/compromised or damaged authenticators, and for revoking authenticators
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: e
      text: |-
        Changing default content of authenticators prior to information system installation
        is an organizational procedural requirement outside the scope of OpenShift configuration.
    - key: f
      text: |-
        Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: g
      text: |-
        Changing/refreshing authenticators by organization-defined time period by authenticator type
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: h
      text: |-
        Protecting authenticator content from unauthorized disclosure and modification
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: i
      text: |-
        Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators
        is an organizational procedural requirement outside the scope of OpenShift configuration.
    - key: j
      text: |-
        Changing authenticators for group/role accounts when membership to those accounts changes
        is an organizational procedural requirement outside the scope of OpenShift configuration.

        To affectively manage information system authenticators in OpenShift, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |-
        Enforcing a minimum password complexity of organization-defined requirements for case sensitivity,
        number of characters, mix of upper-case letters, lower-case letters, numbers, and special
        characters, including minimum requirements for each type is outside the scope of OpenShift
        configuration.

        To affectively use password-based authentication, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: b
      text: |-
        Enforcing at least an organization-defined number of changed characters when new passwords are created
        is outside the scope of OpenShift configuration.

        To affectively use password-based authentication, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: c
      text: |-
        Storing and transmitting only cryptographically-protected passwords
        is outside the scope of OpenShift configuration.

        To affectively use password-based authentication, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: d
      text: |-
        Enforcing password minimum and maximum lifetime restrictions of organization-defined numbers for
        lifetime minimum and maximum is outside the scope of OpenShift configuration.

        To affectively use password-based authentication, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: e
      text: |-
        Prohibiting password reuse for organization-defined number generations
        is outside the scope of OpenShift configuration.

        To affectively use password-based authentication, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html
    - key: f
      text: |-
        Allowing the use of a temporary password for system logons with an immediate change
        to a permanent password is outside the scope of OpenShift configuration.

        To affectively use password-based authentication, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-327
    - key: b
      text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-327
    - key: c
      text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-327
    - key: d
      text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-327

- control_key: IA-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Organizational requirements that the registration process to
        receive organization-defined types of and/or specific authenticators
        be conducted either in person and/or by a trusted third party before
        organization-defined registration authority with authorization by
        organization-defined personnel or roles is outside the scope of
        OpenShift configuration.

- control_key: IA-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-328

- control_key: IA-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This is an organizational procedural requirement
        outside the scope of OpenShift configuration.

- control_key: IA-5 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This is an organizational procedural requirement
        outside the scope of OpenShift configuration.

- control_key: IA-5 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A control response for IA-5(7) is planned.

- control_key: IA-5 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Organizational implementation of organization-defined security
        safeguards to manage the risk of compromise due to individuals having
        accounts on multiple information systems is outside the scope of
        OpenShift configuration.

- control_key: IA-5 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Organizational coordination with organization-defined
        external organizations for cross-organization management
        of credentials is outside the scope of OpenShift configuration.

- control_key: IA-5 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-330

- control_key: IA-5 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Employment of mechanisms that satisfy organization-defined
        token quality requirements is outside the scope of
        OpenShift configuration.

- control_key: IA-5 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Employment of mechanisms that satisfy organization-defined
        biometric quality requirements is outside the scope of
        OpenShift configuration.

- control_key: IA-5 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-331

- control_key: IA-5 (14)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-331

- control_key: IA-5 (15)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-332

- control_key: IA-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        By default, OpenShift Container Platform session key and account login
        passwords are obscured by not being displayed on output or by asterisks.

- control_key: IA-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-334

- control_key: IA-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |-
        A control response for IA-8 is planned.

- control_key: IA-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        Acceptance and electronically verified Personal Identity Verification (PIV) credentials
        from other federal agencies is outside the scope of OpenShift configuration
        and is the responsibility of a third-party identity provider.

        To affectively use PIV credentials, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Acceptance of FICAM-approved third-party credentials
        is outside the scope of OpenShift configuration
        and is the responsibility of a third-party identity provider.

        To affectively use FICAM credentials, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html


- control_key: IA-8 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Employment of only FICAM-approved information system
        components (e.g. cards, card holders, physical access
        control system components) in organization-defined
        information systems to accept third-party credentials
        is outside the scope of OpenShift configuration
        and is the responsibility of a third-party identity provider.

        To affectively use FICAM components, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-8 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Usage of FICAM-issued profiles is outside the scope of
        OpenShift configuration and is the responsibility of a
        third-party identity provider.

        To affectively use FICAM profiles, configuring an
        indentity provider is required. Documentation on supported authentication providers
        can be found in the OpenShift product documentation:

        https://docs.openshift.com/container-platform/latest/authentication/understanding-identity-provider.html

- control_key: IA-8 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-336

- control_key: IA-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-337

- control_key: IA-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-338

- control_key: IA-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-339

- control_key: IA-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        Requiring that individuals accessing the information system employ
        organization-defined supplemental authentication techniques or
        mechanisms under specific organization-defined circumstances or
        situations is outside the scope of OpenShift configuration.

- control_key: IA-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |-
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-340
##
## BEGINNING OF:
## INCIDENT RESPONSE
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: IR-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.1
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.2
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b.1
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b.2
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

##
## Note to content authors:
##  IR-2 (1) relates to creating simulated events/scenarios
##  relating to incident response. While this is an organizational
##  control, consider creating component-specific incident
##  response simulations as appropriate (e.g. if a virtualization
##  product, what happens after a VM escape?).
##
- control_key: IR-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

##
## Note to content authors:
##  IR-4 (2) is *technically* an organizational control, however
##  many accreditors/auditors will want to understand how the
##  system component integrates with dynamic reconfiguration capabilities.
##  Lacking formal guidance from the government, some auditors expect a
##  response to this control at the component level.
##
- control_key: IR-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-4 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policies and is not
        applicable to OpenShift configuration.

##
## Note to content authors:
##  Often 3rd party auditors will incorrectly state satisfaction of IR-5 (1)
##  relates to centralized audit logging of security events.
##
##  Central audit logging is covered under other controls, namely:
##  - AU-6 (3) - Correlate Audit Repositories
##  - AU-6 (4) - Central Review and Analysis
##  - AU-12 - Audit Generation
##
- control_key: IR-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.1
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.2
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.3
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.4
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.5
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.6
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.7
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.8
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: e
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: f
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: e
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: f
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: IR-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-9 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-9 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.

- control_key: IR-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies and is not
        applicable to OpenShift configuration.
##
## BEGINNING OF:
## MAINTENANCE
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: MA-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: e
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: f
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: MA-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-341
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-341

- control_key: MA-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Checking media containing diagnostic and test programs for
        malicious code before the media are used in the information
        system is outside the scope of OpenShift configuration.

- control_key: MA-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Preventing the unauthorized removal of maintenance equipment containing
        organizational information by verifying that there is no organizational
        information contained on the equipment is outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Preventing the unauthorized removal of maintenance equipment containing
        organizational information by sanitizing or destroying the equipment is
        outside the scope of OpenShift configuration.
    - key: c
      text: |
        Preventing the unauthorized removal of maintenance equipment containing
        organizational information by retaining the equipment within the
        facility is outside the scope of OpenShift configuration.
    - key: d
      text: |
        Preventing the unauthorized removal of maintenance equipment containing
        organizational information by obtaining an exception from
        organization-defined personnel or roles explicity authorizing removal
        of the equipment from the facility is outside the scope of OpenShift
        configuration.

- control_key: MA-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        Approving and monitoring nonlocal maintenance and diagnostic activities is an
        orgnaizational control outside the scope of OpenShift configuration.
    - key: b
      text: |
        Allowing the use of nonlocal maintenance and diagnostic tools only as consistent with
        organizational policy and documented in the security plan for the information system is an
        orgnaizational control outside the scope of OpenShift configuration.
    - key: c
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-343
    - key: d
      text: |
        The maintaining of records for nonlocal maintenance and diagnostic activities is an
        orgnaizational control outside the scope of OpenShift configuration.
    - key: e
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-343

- control_key: MA-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-344
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-371

- control_key: MA-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-372
    - key: b
      text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-345

- control_key: MA-4 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Approval of each nonlocal maintenance session by
        organization-defined personnel or roles is outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Notification of organization-defined personnel or roles of
        the date and time of planned nonlocal maintenance is outside
        the scope of OpenShift configuration.

- control_key: MA-4 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-346

- control_key: MA-4 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Engineering progress can be tracked via:

        https://issues.redhat.com/browse/CMP-347

- control_key: MA-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Establishing a process for maintenance personnel authorization and
        maintaining a list of authorized maintenance organizations or personnel
        is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Ensuring that non-escorted personnel performing maintenance on
        the information system have required access authorizations is
        outside the scope of OpenShift configuration.
    - key: c
      text: |
        Designating organizational personnel with required access
        authorizations and technical competence to supervise the
        maintenance activities of personnel who do not possess
        the required access authorizations is outside the
        scope of OpenShift configuration.

- control_key: MA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Implementing organizational procedures for the use of maintenance
        personnel that lack appropriate security clearances or are not U.S.
        citizens is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Development and implementation of alternate security safeguards
        in the event an information system component cannot be sanitized,
        removed, or disconnected from the system, is outside the scope
        of OpenShift configuration.

- control_key: MA-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes ensuring that personnel performing
        maintenance and diagnostic activities on an information system
        processing, storing, or transmitting classified information
        possess security clearances and formal access approvals for at
        least the highest classification level and for all compartments
        of information on the system, is outside the scope of OpenShift
        configuration.

- control_key: MA-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes ensuring that personnel performing
        maintenance and diagnostic activities on an information system
        processing, storing, or transmitting classified information are
        U.S. citizens, is outside the scope of OpenShift configuration.

- control_key: MA-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes that ensure cleared foreign nationals (i.e.
        foreign nationals with appropriate security clearances), are used
        to conduct maintenance and diagnostic activities on classified
        information systems only when the systems are jointly owned and
        operated by the United States and foreign allied governments, or
        owned and operated solely by foreign allied governments, is outside
        the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes that ensure approvals, consents, and detailed
        operational conditions regarding the use of foreign nationals to
        conduct maintenance and diagnostic activities on classified information
        systems are fully documented within Memoranda of Agreements, is outside
        the scope of OpenShift configuration.

- control_key: MA-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes ensuring that non-escorted personnel
        performing maintenance activities not directly associated with
        the information system but in the physical proximity of the
        system, have required access authorizations, is outside the
        scope of OpenShift configuration.

- control_key: MA-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

        OpenShift logging and monitoring may occasionally require maintenance.

        Documentation for configuring the native OpenShift Elasticsearch Kibana
        FluentD logging stack can be found at:
        https://docs.openshift.com/container-platform/latest/logging/cluster-logging.html

        Documentation updates and control progress can be tracked at:
        https://issues.redhat.com/browse/CMP-348

- control_key: MA-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: MA-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
##
## BEGINNING OF:
## MEDIA PROTECTION
##

- control_key: MP-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: d
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-6 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-6 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-6 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control was withdrawn by NIST.

- control_key: MP-6 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-6 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        OpenShift does not utilize or have access to media such as optical
        drives, USB devices, etc. Therefore, this control is not applicable to
        Openshift.

- control_key: MP-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: d
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-8 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: MP-8 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
##
## BEGINNING OF:
## PHYSICAL AND ENVIRONMENTAL PROTECTION
##

- control_key: PE-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Development, documentation, and dissemination of a physical
        and environmental protection policy reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.
    - key: b
      text: |
        Organizational review and updates to the physical and
        environmental protection policy reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.

- control_key: PE-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Development, approval, and maintenance of a list
        of individuals with authorized access to the facility
        where the information system resides reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.
    - key: b
      text: |
        Issuing authorization credentials for facility access
        reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: c
      text: |
        Reviewing the access list detailing authorized facility
        access by individuals at an organization-defined frequency
        reflects organizational procedure/policy and is not
        applicable to component-level configuration.
    - key: d
      text: |
        Removal of individuals from the facility access list when access
        is no longer required reflects organizational procedure/policy
        and is not applicable to component-level configuration.

- control_key: PE-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Authorizing physical access to the facility where the information
        system resides based on position or role reflects organizational
        procedures/policy and is not applicable to component-level
        configuration.

- control_key: PE-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Requiring two forms of identification from an organization-defined
        list of acceptable forms of identification for visitor access to
        the facility where the information system resides reflects
        organizational procedure/policy and is not applicable to
        component-level configuration.

- control_key: PE-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Restricting unescorted access to the facility where the
        information system resides reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.

- control_key: PE-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Enforcing physical access authorizations at organization-defined
        entry/exit points to the facility where the information system resides
        reflects organizational procedure/policy and is not applicable to
        component-level configuration.
    - key: b
      text: |
        Maintaining physical access audit logs for organization-defined
        entry/exit points reflects organizational procedure/policy and
        is not applicable to component-level configuration.
    - key: c
      text: |
        Providing organization-defined security safeguards to control access
        to areas within the facility officially designated as publicly
        accessible reflects organizational procedure/policy and
        is not applicable to component-level configuration.
    - key: d
      text: |
        Escorting visitors and monitoring visitor activity during
        organization-defined circumstances requiring visitor escorts
        and monitoring reflects organizational procedure/policy and
        is not applicable to component-level configuration.
    - key: e
      text: |
        Securing keys, combinations, and other physical access devices
        reflects organizational procedure/policy and
        is not applicable to component-level configuration.
    - key: f
      text: |
        Inventory of organization-defined physical access devices
        at an organization-defined frequency reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.
    - key: g
      text: |
        Changing combinations and keys at an organization-defined frequency
        and/or when keys are lost, combinations are compromised, or individuals
        are transferred or terminated, reflects organizational procedure/policy
        and is not applicable to component-level configuration.

- control_key: PE-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Enforcing physical access authorizations to the information system
        in addition to the physical access controls for the facility at
        organization-defined physical spaces containing one or more components
        of the information system reflects organizational procedure/policy
        and is not applicable to component-level configuration.

- control_key: PE-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Performing security checks at an organization-defined
        frequency at the physical boundary of the facility or information
        system for unauthorized exfiltration of information or removal
        of information system components reflects organizational
        procedure/policy and is not applicable to
        component-level configuration.

- control_key: PE-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employing guards and/or alarms to monitor every physical access
        point to the facility where the information system resides 24 hours
        per day, 7 days per week, reflects organizational procedure/policy and
        is not applicable to component-level configuration.

- control_key: PE-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Using lockable physical casings to protect organization-defined
        information system components from unauthorized physical access
        reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: PE-3 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employing organization-defined security safeguards to
        detect and/or prevent physical tampering or alteration of
        organization-defined hardware components within the information
        system reflects organizational procedure/policy and is not
        applicable to component-level configuration.

- control_key: PE-3 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employing a penetration testing process that includes, at an
        organization-defined frequency, unannounced attempts to bypass or
        circumvent security controls associated with physical access points
        to the facility reflects organizational procedure/policy and is
        not applicable to component-level configuration.

- control_key: PE-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Controlling physical access to organization-defined information
        system distribution and transmission lines within organizational
        facilities using organizaiton-defined security safeguards reflects
        organizational procedure/policy and is not applicable to
        component-level configuration.

- control_key: PE-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Controlling physical access to information system output devices to
        prevent unauthorized individuals from obtaining the output reflects
        organizational policy/procedures and is not applicable to
        component-level configuration.

- control_key: PE-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Controlling physical access to output from organization-defined
        output devices reflects organizational procedures/policy and
        is outside the scope of component-level configuration.
    - key: b
      text: |
        Ensuring that only authorized individuals receive output
        from the device reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.

- control_key: PE-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Controlling physical access to output from organization-defined
        output devices reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.
    - key: b
      text: |
        Linking individual identity to receipt of the output
        from the device reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.

- control_key: PE-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Marking organization-defined information system output devices
        indicating the appropriate security marking of the information
        permitted to be output from the device reflects organizational
        procedure/policy and is outside the scope of component-level
        configuration.

- control_key: PE-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Monitoring physical access to the facility where the information
        system resides to detect and respond to physical security incidents
        reflects organizational procedure/policy and is outside the scope
        of component-level configuration.
    - key: b
      text: |
        Reviewing physical access logs at an organization-defined
        frequency and upon occurence of organization-defined events
        or potential indications of events, reflects organizational
        procedure/policy and is not applicable to component-level
        configuration.
    - key: c
      text: |
        Coordinating results of reviews and investigations with
        the organizational incident response capability reflects
        organizational procedure/policy and is not applicable to
        component-level configuration.

- control_key: PE-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Monitoring physical intrusion alarms and surveillance
        equipment reflects organizational procedure/policy and is
        not applicable to component-level configuration.

- control_key: PE-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-6 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: b
      text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: b
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: c
      text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-10 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-11 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-11 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: b
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: c
      text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-12 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-13 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-13 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-13 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-13 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: b
      text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-14 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-14 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-15 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-17
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: b
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: c
      text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-18
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-18 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-19
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-19 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control is outside the scope of OpenShift configuration.

- control_key: PE-20
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control is outside the scope of OpenShift configuration.
    - key: b
      text: |
        This control is outside the scope of OpenShift configuration.
##
## BEGINNING OF:
## PLANNING
##

- control_key: PL-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: PL-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: e
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: PL-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into PL-7.

- control_key: PL-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into PL-8.

- control_key: PL-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PL-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into PL-2.

- control_key: PL-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: PL-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PL-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into Appendix J, AR-2.

- control_key: PL-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into PL-2.

- control_key: PL-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: PL-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: PL-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: PL-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PL-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
##
## BEGINNING OF:
## PROGRAM MANAGEMENT
##

- control_key: PM-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: d
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: PM-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |-
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
##
## BEGINNING OF:
## PERSONNEL SECURITY
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: PS-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational development, documentation, and dissemination of
        a personnel security policy to organization-defined personnel
        is outside the scope of OpenShift configuration.
    - key: a.1
      text: |
        Organizational development, documentation, and dissemination of
        a personnel security policy to organization-defined personnel
        is outside the scope of OpenShift configuration.
    - key: a.2
      text: |
        Organizational development, documentation, and dissemination of
        a personnel security policy to organization-defined personnel
        is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational reviews and updates to the personnel security policy
        and personnel security procedures at an organization-defined frequency
        is outside the scope of OpenShift configuration.
    - key: b.1
      text: |
        Organizational development, documentation, and dissemination of
        a personnel security policy to organization-defined personnel
        is outside the scope of OpenShift configuration.
    - key: b.2
      text: |
        Organizational development, documentation, and dissemination of
        a personnel security policy to organization-defined personnel
        is outside the scope of OpenShift configuration.

- control_key: PS-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational assignment of a risk designation to all organizational
        positions is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational establishment of screening criteria for individuals
        filling those positions is outside the scope of OpenShift
        configuration.
    - key: c
      text: |
        Organizational review and updating of position risk
        designations at an organization-defined frequency is outside the scope
        of OpenShift configuration.

- control_key: PS-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational screening of individuals prior to authorizing access
        to the information system is outside the scope of OpenShift
        configuration.
    - key: b
      text: |
        Organizational processes to rescreen individuals according to
        organization-defined conditions requiring rescreening and,
        where rescreening is so indicated, the frequency of such
        rescreening, is outside the scope of OpenShift
        configuration.

- control_key: PS-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes ensuring that individuals accessing an
        information system processing, storing, or transmitting classified
        information are cleared and indoctrinated to the highest classification
        level of the information to which they have access on the system,
        are outside the scope of OpenShift configuration.

- control_key: PS-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes ensuring that individuals accessing an
        information system processing, storing, or transmitting types of
        classified information which require formal indoctrination, are
        formally indoctrinated for all of the relevant types of information
        to which they have access on the system, are outside the scope
        of OpenShift configuration.

- control_key: PS-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes ensuring that individuals accessing an
        information system processing, storing, or transmitting information
        requiring special protection have valid access authorizations that are
        demonstrated by assigned official government dutues, are outside the
        scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes ensuring that individuals accessing an
        information system processing, storing, or transmitting information
        requiring special protection satisgy organization-defined additional
        personnel screening criteria, are outside the scope of OpenShift
        configuration.

- control_key: PS-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes ensuring that, upon termination of individual
        employment, information system access is disabled within an
        organization-defined time period, are outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational processes ensuring that, upon termination of individual
        employment, any authenticators/credentials associated with the individual
        are terminated/revoked, are outside the scope of
        OpenShift configuration.
    - key: c
      text: |
        Organizational processes ensuring that, upon termination of individual
        employment, exit interviews are conducted that include a discussion of
        organization-defined information security topics, are outside the scope
        of OpenShift configuration.
    - key: d
      text: |
        Organizational processes ensuring that, upon termination of individual
        employment, all security-related organizational information
        system-related property is retrieved, are outside the scope
        of OpenShift configuration.
    - key: e
      text: |
        Organizational processes ensuring that, upon termination of individual
        employment, the organization retains access to organizational
        information systems formerly controlled by the terminated individual,
        are outside the scope of OpenShift configuration.
    - key: f
      text: |
        Organizational processes ensuring that, upon termination of individual
        employment, the organization notifies organization-defined personnel
        or roles within an organization-defined time period, are outside
        the scope of OpenShift configuration.

- control_key: PS-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes which notify terminated individuals of
        applicable, legally binding post-employment requirements for
        the protection of organizational information are outside
        the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes requiring terminated individuals
        to sign an acknowledgement of post-employment requirements
        as part of the organizational termination process
        are outside the scope of OpenShift configuration.

- control_key: PS-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational employment of automated mechanisms to notify
        organization-defined personnel or roles upon termination of
        an individual, is outside the scope of
        OpenShift configuration.

- control_key: PS-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to review and confirm ongoing operational
        need for current logical and physical access authorizations to
        information systems/facilities when individuals are reassigned or
        transferred to other positions within the organization are
        outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes to initiate organization-defined transfer
        or reassignment actions within organization-defined time period
        following the formal transfer action are outside the scope of
        OpenShift configuration.
    - key: c
      text: |
        Organizational processes to modify access authorizations as needed to
        correspond with any changes in oeprational need due to reassignment
        or transfer are outside the scope of OpenShift configuration.
    - key: d
      text: |
        Organizational notifications of organization-defined personnel
        or roles within an organization-defined time period are outside
        the scope of OpenShift configuration.

- control_key: PS-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational process to develop and document access agreements for
        organizational information systems are outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational reviews and updates to the access agreements at an
        organization-defined frequency are outside the scope of
        OpenShift configuration.
    - key: c
      text: |
        Organizational processes that ensure individuals requiring access to
        organizational information and information systems sign and re-sign
        access agreements are outside the scope of OpenShift configuration.
    - key: c.1
      text: |
        Organizational processes that ensure individuals requiring access to
        organizational information and information systems sign and re-sign
        access agreements are outside the scope of OpenShift configuration.
    - key: c.2
      text: |
        Organizational processes that ensure individuals requiring access to
        organizational information and information systems sign and re-sign
        access agreements are outside the scope of OpenShift configuration.

- control_key: PS-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: PS-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes that ensure access to classified information
        requiring special protection is granted only to individuals who
        have a valid access authorization that is demonstrated by assigned
        official government duties are outside the scope of OpenShift
        configuration.
    - key: b
      text: |
        Organizational processes that ensure access to classified information
        requiring special protection is granted only to individuals who
        satisfy associated personnel security criteria are outside
        the scope of OpenShift configuration.
    - key: c
      text: |
        Organizational processes that ensure access to classified information
        requiring special protection is granted only to individuals who
        have read, understood, and signed a nondisclosure agreement are
        outside the scope of OpenShift configuration.

- control_key: PS-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to notify individuals of applicable, legally
        binding post-employment requirements for protection of organizational
        information are outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes which require individuals to sign
        an acknowledgement of these requirements, if applicable, as
        part of granting initial access to covered information, are
        outside the scope of OpenShift configuration.

- control_key: PS-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to establish security requirements including
        security roles and responsibilities for third-party providers are
        outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes requiring third-party providers to comply
        with personnel security polocies and procedures established by
        the organization are outside the scope of OpenShift configuration.
    - key: c
      text: |
        Organizational processes to document presonnel security requirements
        are outside the scope of OpenShift configuration.
    - key: d
      text: |
        Organizational processes to require third-party providers to notify
        organization-defined personnel or roles of any personnel transfers or
        terminations of third-party personnel who possess organizational
        credentials and/or badges, or who have information system privileges
        within an organization-defined time period, are outside the
        scope of OpenShift configuration.
    - key: e
      text: |
        Organizational monitoring of provider compliance is outside
        the scope of OpenShift configuration.

- control_key: PS-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational employment of a formal sanctions process for individuals
        failing to comply with established information security policies
        and procedures is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational notification of organization-defined personnel
        or roles within an organization-defined time period when a formal
        employee santions process is initiated, identifying the individual
        sanctioned and the reason for the sanction.
##
## BEGINNING OF:
## RISK ASSESSMENT
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: RA-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational development, documentation, and dissemination to
        organization-defined personnel or roles a risk assessment policy
        and procedures is outside the scope of OpenShift configuration.
    - key: a.1
      text: |
        Organizational development, documentation, and dissemination to
        organization-defined personnel or roles a risk assessment policy
        and procedures is outside the scope of OpenShift configuration.
    - key: a.2
      text: |
        Organizational development, documentation, and dissemination to
        organization-defined personnel or roles a risk assessment policy
        and procedures is outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational review and updates to the risk assessment policy
        and risk assessment procedures is outside the scope of
        OpenShift configuration.
    - key: b.1
      text: |
        Organizational review and updates to the risk assessment policy
        and risk assessment procedures is outside the scope of
        OpenShift configuration.
    - key: b.2
      text: |
        Organizational review and updates to the risk assessment policy
        and risk assessment procedures is outside the scope of
        OpenShift configuration.

- control_key: RA-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to categorize information and information
        systems in accordance with applicable federal laws, Executive
        Orders, directives, policies, regulations, standards, and
        guidance, are outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes to document the security categorization
        results (including supporting rationale) in the security plan for
        the information system are outside the scope of
        OpenShift configuration.
    - key: c
      text: |
        Organizational processes to ensure that the authorizing official
        or authorizing official designated representative reviews and
        approved the security categorization decision are outside
        the scope of OpenShift configuration.

- control_key: RA-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to conduct an assessment of risk,
        including the likelihood and magnitude of harm, from the unauthorized
        access, use, disclosure, disruption, modification, or desctruction of
        the information system and the information it processes, stores, or
        transmits, are outside the scope of OpenShift configuration.
    - key: b
      text: |
        Organizational processes to document risk assessment results in
        security plans, risk assessment reports, or organization-defined
        documents, are outside the scope of OpenShift configuration.
    - key: c
      text: |
        Organizational processes to review risk assessment results at
        an organization-defined frequency are outside the scope
        of OpenShift configuration.
    - key: d
      text: |
        Organizational processes to disseminate risk assessment results to
        organization-defined personnel or roles are outside the scope
        of OpenShift configuration.
    - key: e
      text: |
        Organizational processes to update the risk assessment at an
        organization-defined frequency or whenever there are significant
        changes to the information system or environment of operation
        (including the identification of new threats and vulnerabilities),
        or other conditions that may impact the security state of the system,
        are outside the scope of OpenShift configuration.

- control_key: RA-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: RA-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-352
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-352
    - key: e
      text: |
        Organizational processes to share information obtained from the
        vulnerability scanning process and security control assessments
        with organization-defined personnel or roles to help eliminate
        similar vulnerabilities in other information systems (i.e.,
        systemic weaknesses or deficiences) are outside the scope
        of OpenShift configuration.

- control_key: RA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-353

- control_key: RA-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: RA-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: RA-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-354

- control_key: RA-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        For the purpose of conducting a vulnerability scan of OpenShift, the OpenShift API and nodes
        should be scanned using the OpenShift Compliance Operator. OpenShift supports
        RBAC for users and groups, appropriate vulnerability scans can be performed against
        the OpenShift web application interface. For the OpenShift Compliance Operator, only OpenShift
        Cluster Administators are able to access and run the operator for compliance and vulnerability scans.

- control_key: RA-5 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: partial
  narrative:
    - text: |
        A control response is planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-356

- control_key: RA-5 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: RA-5 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational review of historic audit logs to determine if a
        vulnerability identified in the information system has been
        previously exploited is outside the scope of
        OpenShift configuration.

- control_key: RA-5 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST.

- control_key: RA-5 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational processes to correlate the output from vulnerability
        scanning tools to determine the presence of
        multi-vulnerability/multi-hop attack vectors are outside the scope
        of OpenShift configuration.

- control_key: RA-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Organizational employment of a technical surveillance countermeasures
        survey at organization-defined locations at an organization-defined
        frequency or when organization-defeined events or indicators
        occur is outside the scope of OpenShift configuration.
##
## BEGINNING OF:
## SYSTEM AND SERVICES ACQUISITION
##
## Reminder of "implementation_status" codes:
##  - implementation_status: unsatisfied
##  - implementation_status: unknown
##  - implementation_status: planned
##  - implementation_status: partial
##  - implementation_status: complete
##  - implementation_status: none

- control_key: SA-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to develop, document, and disseminate to
        organization-defined personnel or roles a system and services
        acquisition policy is outside the scope of
        OpenShift configuration.
    - key: a.1
      text: |
        Organizational processes to develop, document, and disseminate to
        organization-defined personnel or roles a system and services
        acquisition policy is outside the scope of
        OpenShift configuration.
    - key: a.2
      text: |
        Organizational processes to develop, document, and disseminate to
        organization-defined personnel or roles a system and services
        acquisition policy is outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational review and updates to the current system and services
        acquisition policy and procedures at an organization-defined frequency
        is outside the scope of OpenShift configuration.
    - key: b.1
      text: |
        Organizational review and updates to the current system and services
        acquisition policy and procedures at an organization-defined frequency
        is outside the scope of OpenShift configuration.
    - key: b.2
      text: |
        Organizational review and updates to the current system and services
        acquisition policy and procedures at an organization-defined frequency
        is outside the scope of OpenShift configuration.

- control_key: SA-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to determine information security requirements
        for the information system or information system service in
        mission/business process planning are outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational processes to determine, document, and allocate the
        resources required to protect the information system or information
        system service as part of its capital planning and investment
        control process are outside the scope of
        OpenShift configuration.
    - key: c
      text: |
        Organizational processes to establish a discrete line item for
        information security in organizational programming and budgeting
        documentation are outside the scope of OpenShift configuration.

- control_key: SA-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to manage the information system using
        organization-defined system development life cycle that incorporates
        information security considerations are outside the scope
        of OpenShift configuration.
    - key: b
      text: |
        Organizational processes to define and document information security
        roles and responsibilities throughout the system development
        life cycle are outside the scope of OpenShift configuration.
    - key: c
      text: |
        Organizational processes to identify individuals having information
        security roles and responsibilities are outside the scope of
        OpenShift configuration.
    - key: d
      text: |
        Organizational processes to integrate the organizational information
        security risk management process into system development life cycle
        activities are outside the scope of OpenShift configuration.

- control_key: SA-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational processes to include security functional requirements
        in acquisition contracts are outside the scope of OpenShift
        configuration.
    - key: b
      text: |
        Organizational processes to include security strength requirements
        in acquisition contracts are outside the scope of OpenShift
        configuration.
    - key: c
      text: |
        Organizational processes to include security assurance requirements
        in acquisition contracts are outside the scope of
        OpenShift configuration.
    - key: d
      text: |
        Organizational processes to include security-related documentation
        requirements in acquisition contracts are outside the scope of
        OpenShift configuration.
    - key: e
      text: |
        Organizational processes to include requirements for protecting
        security-related documentation in acquisition contracts
        are outside the scope of OpenShift configuration.
    - key: f
      text: |
        Organizational processes to include a description of the information
        system development environment and environment in which the system is
        intended to operate in acqusition contracts are outside the scope of
        OpenShift configuration.
    - key: g
      text: |
        Organizational processes to include acceptance criteria in
        acqusition contracts are outside the scope of OpenShift
        configuration.

##
## Developers note on SA-4 (1):
##  This control requires that developers of system components, e.g.
##  application servers, to provide a description of the functional
##  properties of the security controls to be deployed.
##
##  A a generally accepted control response is to provide a security
##  configuration guide, such as a NIST National Checklist or DoD
##  STIG, for the component.
##
##  In absence of an approved government configuration baseline,
##  note this requirement is satisfied by a *description* of
##  functional properties. Implementation details are offered in
##  SA-4(2).
##
- control_key: SA-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-4 (1) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-360

##
## Developers note on SA-4 (2):
##  This control differs from SA-4 (1) in that implementation
##  details are now required.
##
##  The majority of FedRAMP and FISMA Moderate systems refine this control
##  with the following:
##    - Provide design and implementation regarding security-relevant
##      external system interfaces and high-level design;
##    - Provide design and implementation information required by the
##      SDL process;
##    - Above should be provided with a level of detail sufficient for
##      secure deployment.
##
- control_key: SA-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-4 (2) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-361

##
## Developers note on SA-4 (3):
##  This is most frequently satisfied by demonstrating common criteria
##  certification.
##
##  Lacking Common Criteria certification a detailed outline of SDLC practices
##  is required.
##
- control_key: SA-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-4 (3) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-362

- control_key: SA-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into CM-8 (9).

##
## Developers note on SA-4 (4):
##  Note: For software components, such as operating systems, NIST considers it
##  sufficient to provide install-time configuration. For example in RHEL7 a
##  "Security Profile" menu is presented that installs Linux into known government
##  baselines.
##
- control_key: SA-4 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-4(5)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-363
    - key: b
      text: |
        A control response to SA-4(5)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-363

##
## Developers note on SA-4 (6):
##  Note this is only applicable "when the networks used to transmit
##  the information are at a lower classification than the information
##  being transmitted."
##
##  If this component is not intended to enable cross domain infrastructure,
##  this control potentially could be 'not applicable'.
##
- control_key: SA-4 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Organizational employment of only government off-the-shelf
        (GOTS) or commercial off-the-shelf (COTS) information assurance
        (IA) and IA-enabled information technology products that compose
        an NSA-approved solution to protect classified information when
        the networks used to transmit the information are at a lower
        classificiation level than the information transmitted, is
        an organizational control outside the scope of
        OpenShift configuration.
    - key: b
      text: |
        Organizational assurance that these products have been evaluated
        and/or validated by NSA or in accordance with NSA-approved
        procedures is an organizational control outside the scope
        of OpenShift configuration.

        NOTE: As of September 2019, OpenShift has not undergone formal NSA
        evaluation for the inclusion in cross domain information
        systems.

##
## Developers note on SA-4 (7):
##  As of 2018, protection profiles recognized by NIAP and those recognized
##  by the broader Common Criteria effort have diverged. A listing of NIAP-
##  recognized protection profiles can be found here:
##
##  https://www.niap-ccevs.org/Profile/PP.cfm
##
- control_key: SA-4 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-4(7)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-364
    - key: b
      text: |
        A control response to SA-4(7)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-364

##
## Developers note on SA-4 (8):
##  A successful control response will document how to achieve continuous
##  monitoring of control/standards as identified in CA-7.
##
- control_key: SA-4 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-4(8) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-365

##
## Developers note on SA-4 (9):
##  A successful control response will document all network
##  information. Take care to document internal network usage,
##  including loopback devices, as it is customary to block all
##  traffic not explicitly outlined in this control.
##
- control_key: SA-4 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-4(9) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-366

- control_key: SA-4 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-5(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: a.1
      text: |
        A control response to SA-5(a)(1) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: a.2
      text: |
        A control response to SA-5(a)(2) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: a.3
      text: |
        A control response to SA-5(a)(3) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: b
      text: |
        A control response to SA-5(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: b.1
      text: |
        A control response to SA-5(b)(1) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: b.2
      text: |
        A control response to SA-5(b)(2) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-367
    - key: b.3
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: d
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: e
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-4 (1).

- control_key: SA-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-4 (2).

- control_key: SA-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-4 (3).

- control_key: SA-5 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-4 (4).

- control_key: SA-5 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-4 (5).

- control_key: SA-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into CM-10 and SI-7.

- control_key: SA-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into CM-11 and SI-7.

- control_key: SA-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-9 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-9 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-9 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-9 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-9 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-9(5) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-368

##
## Developers note on SA-10
##  A successful control response will document all network
##  information. Take care to document internal network usage,
##  including loopback devices, as it is customary to block all
##  traffic not explicitly outlined in this control.
##
- control_key: SA-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    ## A successful control response will document performance of configuration
    ## management. Processes and mechanisms involved in configuration management
    ## will need to be addressed.
    - key: a
      text: |
        A control response to SA-10(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-369

    ## A successful control response will need to address the processes
    ## and mechanisms involved in documenting, managing, and controlling the
    ## integrity of chances.
    - key: b
      text: |
        A control response to SA-10(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-369

    ## A successful control response will need to address the approval process
    ## and safeguards in place to ensure only approved changes are implemented.
    - key: c
      text: |
        A control response to SA-10(c) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-369

    ## A successful control response will need to discuss the process for
    ## documentation.
    - key: d
      text: |
        A control response to SA-10(d) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-369

    ## A successful control response will need to discuss the process
    ## and tools used for tracking, resolution, and reporting.
    - key: e
      text: |
        A control response to SA-10(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-369

##
## Developers note on SA-10 (1)
##  A successful control response will need to address the process and
##  mechanisms involved in integrity verification.
##
##  For example, TPM+TXT for hardware and operating systems.
##
- control_key: SA-10 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-10(1) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-373

- control_key: SA-10 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

##
## Developers note on SA-10 (3)
##  This control differs from SA-10 (1) by focusing on hardware
##  (vs software and firmware).
##
##  This control may not be applicable if the component being documented
##  is not involved in the system boot process.
##
- control_key: SA-10 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

##
## Developers note on SA-10 (4)
##  This control may not be applicable if the component being documented
##  is not involved in the system boot process.
##
- control_key: SA-10 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-10 (4) is planned.

##
## Developers note on SA-10 (4)
##  tbd
##
- control_key: SA-10 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-10 (6) is planned.

##
## Developers note on SA-10 (4)
##  tbd
##
- control_key: SA-10 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-10 (6) is planned.

- control_key: SA-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-11(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-374
    - key: b
      text: |
        A control response to SA-11(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-374
    - key: c
      text: |
        A control response to SA-11(c) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-374
    - key: d
      text: |
        A control response to SA-11(d) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-374
    - key: e
      text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-374

- control_key: SA-11 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-375

- control_key: SA-11 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-376

- control_key: SA-11 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-11(3)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-377
    - key: b
      text: |
        A control response to SA-11(3)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-377

- control_key: SA-11 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(4) is planned.

- control_key: SA-11 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-378

- control_key: SA-11 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-379

- control_key: SA-11 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-380

- control_key: SA-11 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-11(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-381

- control_key: SA-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-12 is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-382

- control_key: SA-12 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-12(1).

- control_key: SA-12 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-12(13).

- control_key: SA-12 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-12(1).

- control_key: SA-12 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-12(10) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-463

- control_key: SA-12 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (14)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-12 (15)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-14 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        As of NIST 800-53 rev4 this control was withdrawn
        and incorporated into SA-20.

- control_key: SA-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-15(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-383
    - key: a.1
      text: |
        A control response to SA-15(a)(1) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-383
    - key: a.2
      text: |
        A control response to SA-15(a)(2) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-383
    - key: a.3
      text: |
        A control response to SA-15(a)(3) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-383
    - key: a.4
      text: |
        A control response to SA-15(a)(4) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-382
    - key: b
      text: |
        A control response to SA-15(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-382

- control_key: SA-15 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-15(1)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-384
    - key: b
      text: |
        A control response to SA-15(1)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-384

- control_key: SA-15 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-15(2) is planned.

- control_key: SA-15 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
         A control response to SA-15(3) is planned.

- control_key: SA-15 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: c
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-15 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-15(5) is planned.

- control_key: SA-15 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-15(6) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-385

- control_key: SA-15 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        A control response to SA-15(7)(a) is planned.
    - key: b
      text: |
        A control response to SA-15(7)(b) is planned.
    - key: c
      text: |
        A control response to SA-15(7)(c) is planned.
    - key: d
      text: |
        A control response to SA-15(7)(d) is planned.

- control_key: SA-15 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-15(8) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-386

- control_key: SA-15 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-15 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-15(10) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-387

- control_key: SA-15 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-15(11) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-388

- control_key: SA-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-16 is planned.

- control_key: SA-17
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-17(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-389
    - key: b
      text: |
        A control response to SA-17(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-389
    - key: c
      text: |
        A control response to SA-17(c) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-389

- control_key: SA-17 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-17 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-17(2)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-449
    - key: b
      text: |
        A control response to SA-17(2)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-449

- control_key: SA-17 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-17(3)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-450
    - key: b
      text: |
        A control response to SA-17(3)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-450
    - key: c
      text: |
        A control response to SA-17(3)(c) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-450
    - key: d
      text: |
        A control response to SA-17(3)(d) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-450
    - key: e
      text: |
        A control response to SA-17(3)(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-450

- control_key: SA-17 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-17(4)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-451
    - key: b
      text: |
        A control response to SA-17(4)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-451
    - key: c
      text: |
        A control response to SA-17(4)(c) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-451
    - key: d
      text: |
        A control response to SA-17(4)(d) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-451
    - key: e
      text: |
        A control response to SA-17(4)(e) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-451

- control_key: SA-17 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-17(5)(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-452
    - key: b
      text: |
        A control response to SA-17(5)(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-452

- control_key: SA-17 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-17(6) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-453

- control_key: SA-17 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-17(7) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-454

- control_key: SA-18
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-18 is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-455

- control_key: SA-18 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-18(1) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-456

- control_key: SA-18 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response to SA-18(2) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-457

- control_key: SA-19
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-19 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-19 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-19 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-19 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-20
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-21
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-21(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-460
    - key: b
      text: |
        A control response to SA-21(b) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-460

- control_key: SA-21 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response to SA-21 is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-464

- control_key: SA-22
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        Red Hat provides a published product life cycle for Red Hat
        OpenShift Container Platform. The product life cycle for Red Hat
        OpenShift Container Platform 4.x can be viewed at:

        https://access.redhat.com/support/policy/updates/openshift

        A control response to SA-22(a) is planned. Progress
        can be tracked at:

        https://issues.redhat.com/browse/CMP-465
    - key: b
      text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.

- control_key: SA-22 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedure/policy and is not
        applicable to OpenShift configuration.
##
## BEGINNING OF:
## SYSTEMS AND COMMUNICATIONS PROTECTION
##

- control_key: SC-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for separating user functionality
        including user interface services) from information system management
        functionality. A successful control response will indicate how user
        and management functionality access is separated.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-429

- control_key: SC-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-466

- control_key: SC-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for deployment utilizing namespaces,
        host roles and other features as well as policies and procedures
        to implement and ensure continued isolation of security functions
        from non-security functions.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-467

- control_key: SC-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for deployment utilizing namespaces,
        host roles and other features as well as policies and procedures
        to implement and ensure continued isolation of security functions
        from non-security functions.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-468

- control_key: SC-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for deployment utilizing namespaces,
        host roles and other features as well as policies and procedures
        to implement and ensure continued isolation of security functions
        from non-security functions.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-469

- control_key: SC-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-470

- control_key: SC-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-471

- control_key: SC-3 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-472

- control_key: SC-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for preventing unauthorized and
        unintended information transfer via shared system resources. A
        successful control response will discuss how this is prevented.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-428

- control_key: SC-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-4.

- control_key: SC-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        This control is met when SELinux is enabled and enforced and through
        the use of SELinux MCS Levels.

- control_key: SC-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-427

- control_key: SC-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-474

- control_key: SC-5 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-475

- control_key: SC-5 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for the protection and availability of
        resources by allocating processor and memory resources by process
        priority and resource availability. A successful control response will
        discuss how resource availability is protected.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-476

- control_key: SC-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-426
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-426
    - key: c
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-426

- control_key: SC-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-7.

- control_key: SC-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-7.

- control_key: SC-7 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        The customer is responsible for limiting the number of external
        network connetions to the information system. A successful control
        response will indicate the rate limiting procedures and technical
        enforcement.

- control_key: SC-7 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Implementing a managed interface for each external telecommunication service
        is addressed at the network infrastructure layer and is an organizational
        control outside the scope of OpenShift configuration.
    - key: b
      text: |
        Establishing a traffic flow policy for each managed interface for each
        external telecommuncation service is an organizational control outside the
        scope of OpenShift configuration and is typically handled at the network
        infrastructure layer.
    - key: c
      text: |
        Protecting the confidentiality and integrity of the information being transmitted
        across each interface is an organizational control outside the
        scope of OpenShift configuration and is typically handled at the network
        infrastructure layer.
    - key: d
      text: |
        Documenting each exception to the traffic flow policy with a supporting
        mission/business need and duration of that need is an organizational control outside the
        scope of OpenShift configuration and is typically handled at the network
        infrastructure layer.
    - key: e
      text: |
        Reviewing exceptions to the traffic flow policy per the organizationally defined frequency
        and removing exceptions that are no longer supported by an explicit mission/business need
        is an organizational control outside the scope of OpenShift configuration and is typically
        handled at the network infrastructure layer.

- control_key: SC-7 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        The customer will be responsible for ensuring managed interfaces deny
        network traffic by default and allow network communications traffic
        by exception (i.e. deny all, permit by exception).

        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-424

- control_key: SC-7 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-7(18).

- control_key: SC-7 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for implementing mechanisms to
        ensure OpenShift nodes do not act as proxy or relay servers between
        internal and external networks.

- control_key: SC-7 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-477

- control_key: SC-7 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-478
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-478

- control_key: SC-7 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-482

- control_key: SC-7 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-482

- control_key: SC-7 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for implementing host-based
        boundary protection mechanisms. This is often through configuration of
        local firewalld and SELinux policies.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-483

- control_key: SC-7 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for ensuring that OpenShift is
        isolated from other internal information system components by
        implementing physically separate subnetworks with managed
        interfaces to other components of the system. A successful control
        response will discuss the networking configuration to satisfy this
        control.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-484

- control_key: SC-7 (14)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/GRPA-1352

- control_key: SC-7 (15)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-485

- control_key: SC-7 (16)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-486

- control_key: SC-7 (17)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-487

- control_key: SC-7 (18)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-488

- control_key: SC-7 (19)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-7 (20)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        This control is met when SELinux is enabled and configured properly
        with namespaces being used as well.

- control_key: SC-7 (21)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-489

- control_key: SC-7 (22)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-490

- control_key: SC-7 (23)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-491

- control_key: SC-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        The customer will be responsible for configuring TLS for transmitted
        information.

- control_key: SC-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        The customer will be responsible for implimenting cryptographic
        mechanisms to prevent unauthorized disclosure of information and
        detect changes to information during transmission. A successful
        control response will detail how encryption is used for all
        network communications that carry customer data.

- control_key: SC-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-492

- control_key: SC-8 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-493

- control_key: SC-8 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-494

- control_key: SC-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-8.

- control_key: SC-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for terminating network connections
        at the end of the session or after no longer than 30 minutes of
        inactivity. A successful control response will document the technical
        means on how this is established.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-422

- control_key: SC-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-495

- control_key: SC-11 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-496

- control_key: SC-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-421

- control_key: SC-12 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-497

- control_key: SC-12 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-498

- control_key: SC-12 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-499

- control_key: SC-12 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-12.

- control_key: SC-12 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-12.

- control_key: SC-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-420

- control_key: SC-13 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-13.

- control_key: SC-13 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-13.

- control_key: SC-13 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-13.

- control_key: SC-13 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-13.

- control_key: SC-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into AC-2,
        AC-3, AC-5, AC-6, SI-3, SI-4, SI-5, SI-7, SI-10.

- control_key: SC-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Examples of collaborative computing devices include networked white
        boards, TV conference cameras, and remote video systems. This control
        is not applicable because Red Hat OpenShift Container Platform is not
        a collaborative computing device.
    - key: b
      text: |
        Examples of collaborative computing devices include networked white
        boards, TV conference cameras, and remote video systems. This control
        is not applicable because Red Hat OpenShift Container Platform is not
        a collaborative computing device.

- control_key: SC-15 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-15 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-15 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-15 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-500

- control_key: SC-16 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-501

- control_key: SC-17
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-419

- control_key: SC-18
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        Defining acceptable and unacceptable mobile code and mobile code technologies
        are organizational policies/procedures outside the configuration of OpenShift.

        In support of developing policies/procedures for mobile code and mobile code technologies
        OpenShift ships with a JavaScript implementation that is used to power the graphical
        web console that is accessible through a web browser.
    - key: b
      text: |
        Establishing usage restrictions and implementation guidance for acceptable
        mobile code and mobile code technologies are organizational policies/procedures
        outside the configuration of OpenShift.

        In support of developing usage restrictions and implementation guidance for acceptable
        mobile code and mobile code technologies, OpenShift ships with a JavaScript implementation
        that is used to power the graphical web console that is accessible through a web browser.
    - key: c
      text: |
        The customer will be responsible for authorizing, monitoring, and
        controlling the use of mobile code within the system in accordance
        with organizational policies defined in SC-18(a) and SC-18(b).

        In support of authorizing, monitoring, and controlling the use of mobile code,
        OpenShift ships with a JavaScript implementation that is used to power the graphical
        web console that is accessible through a web browser.

- control_key: SC-18 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-18 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-18 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-18 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-18 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-19
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        The customer will be responsible for authorizing, monitoring, and
        controlling the use of VoIP within the system in accordance with
        organizational policies defined in SC-19(a).

- control_key: SC-20
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        OpenShift administrators are responsible for providing
        origin authentication and integrity verification artifacts along
        with authoritative name resolution data returns in response. A
        successful control response will discuss the technical means used to
        accomplish this.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-417
    - key: b
      text: |
        OpenShift administrators are responsible for
        providing means to indicate the security status of child zones and
        enable verification of a chain of trust among parent and child domains.
        A successful control response will discuss the technical means used to
        accomplish this.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-417

- control_key: SC-20 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-20.

- control_key: SC-20 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-502

- control_key: SC-21
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-410

- control_key: SC-21 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-21.

- control_key: SC-22
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        OpenShift administrators are responsible for ensuring
        services are fault-tolerant and implement internal/external role
        separation.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-409

- control_key: SC-23
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for guarding against, for
        example, man in the middle or session hijacking attacks for
        connections to the customer application, for example via the
        use of TLS. A successful control response will address the
        various types of attacks against session authenticity and the
        mechanisms used to protect against those attacks.

        OpenShift uses various TLS algorithms and ciphers to protect
        the authenticity of communications sessions.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-408

- control_key: SC-23 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-503

- control_key: SC-23 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into AC-12 (1).

- control_key: SC-23 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-504

- control_key: SC-23 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-23 (3).

- control_key: SC-23 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-505

- control_key: SC-24
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-506

- control_key: SC-25
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-507

- control_key: SC-26
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-26 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-27
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-508

- control_key: SC-28
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-407

- control_key: SC-28 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer is responsible for implementing cryptographic
        mechanisms to prevent unauthorzed disclosure and modification of
        customer data. A successful control response will outline how
        cryptography is used to ensure integrity of data in rest and
        transport.

        When running on Red Hat Enterprise Linux, full disk encryption
        is possible for data at rest on the OpenShift nodes. For data
        in transport, OpenShift uses cryptographic algorithms and ciphers to
        protect confidentiality and integrity of data in transport.

        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-509

- control_key: SC-28 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-510

- control_key: SC-29
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-511

- control_key: SC-29 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-512

- control_key: SC-30
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-513

- control_key: SC-30 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-30 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-30 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-514

- control_key: SC-30 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-515

- control_key: SC-30 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Employing techniques to obsfuscate system components designated by the organization is
        the sole responsibility of the customer.
        The HTTP web headers that are presented by the OpenShift web console can be modified to
        obscure versions other relevant security details that are commonly leaked by HTTP headers.
        Documentation for the Web Console Operator:
        https://github.com/openshift/console-operator

        Documentation updates and control progress can be tracked at:

        https://issues.redhat.com/browse/CMP-516

- control_key: SC-31
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-517

- control_key: SC-31 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-31 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-518

- control_key: SC-31 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-32
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-33
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SC-8.

- control_key: SC-34
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-34 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-34 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-34 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-35
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-36
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-36 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        To assist with this organizational control, documentation is being
        planned. Progress can be tracked via:

        https://issues.redhat.com/browse/CMP-523

- control_key: SC-37
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-508

- control_key: SC-37 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-38
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-39
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - text: |
        The control is met when SELinux and namespaces are enabled and used.

- control_key: SC-39 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-39 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A complete control response is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-525

- control_key: SC-40
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-40 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-40 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-40 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-40 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-41
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-42
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-42 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-42 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-42 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-43
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SC-44
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
##
## BEGINNING OF:
## SYSTEM AND INFORMATION INTEGRITY
##
- control_key: SI-1
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.1
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.2
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b.1
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b.2
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-2
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        The customer will be responsible for analyzing their OpenShift deployment for
        flaws, reporting on those flaws, and correcting them. A successful
        control response will include a discussion of the process by which
        flaws are discovered and remediated, as well as tools that are used to
        assist in detection and remediation.
    - key: b
      text: |
        The customer will be responsible for testing OpenShift updates
        related to flaw remediation prior to installation. A successful
        control response will discuss the testing process (e.g. the
        nature of the test environment, the types of testing performed,
        the tools in testing, etc.).
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-2(1) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-526

- control_key: SI-2 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be required to employ automated mechanisms on a
        monthly basis to determine the state of information system components
        with regard to flaw remediation on their information systems as
        required by their organizations policy. A successful control response
        will address the customers use of automated tools such as Nessus to
        perform periodic and on-demand scans through their system to determine
        the state of system components with regard to flaw remediation.

        A control response for SI-2(2) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-405

- control_key: SI-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        The customer is responsible for scanning for flaws in their
        information systems and for measuring the time between flaw
        identification and flaw remediation. A successful control response
        will need to address the time between flaw identification and
        remediation using timestamps and calculates the time elapsed
        difference.
    - key: b
      text: |
        The customer will be responsible for scanning for flaws in their
        information systems and for establishing benchmarks for taking
        correctie actions according to their organizational policies. A
        successful control response will need to address the use of
        benchmarks to remediate high, and moderate risk flaws within a
        customer defined period after a flaws discovery.

- control_key: SI-2 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SI-2.

- control_key: SI-2 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-2(5) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-527

- control_key: SI-2 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Removal of previous versions of OpenShift an organization policy and procedure control
        and is out of scope for direct application to OpenShift.
        OpenShift can assist the customer with this process, using strategies
        such as Blue/Green deployments to assist with replacing and removing old versions
        of containerized software applications.
        Customer updates of OpenShift can be done through the `oc adm update --to=<version>'
        command.

        Documentation updates and control progress can be tracked at:

        https://issues.redhat.com/browse/CMP-358

- control_key: SI-3
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        The customer is responsible for ensuring that they employ malicious
        code protection at information system entry, and exit points to detect
        and eradicate malicious code. A successful control response will need
        to address use of code protection mechanisms to protect assets from
        malicious software (i.e. Viruses, malware, rootkits, worms, and
        scripts). In regards to OpenShift, this is generally through
        the use of third party tools.
    - key: b
      text: |
        Updating malicious code protection mechanisms whenever new releases
        are available in accordance with organizational configuration
        management policy and procedures is an organizational control outside
        the scope of OpenShift configuration.
    - key: c
      text: |
        Configuring malicious code protection mechanisms is an organizational control outside
        the scope of OpenShift configuration.
    - key: c.1
      text: |
        Performing periodic scans of the information system per organization-defined frequency
        and real-time scans of files from external sources via endpoints or network entry/exit
        points as the files are downloaded, opened, or executed in accordance with organizational
        security policy is an organizational control outside
        the scope of OpenShift configuration.
    - key: c.2
      text: |
        Blocking malicious code, quarantining malicious code, sending alerts to administrator, or
        some other organization-defined action in response to malicious code detection is an organizational control outside
        the scope of OpenShift configuration.
    - key: d
      text: |
        Addressing the receipt of false positives during malicious code detection and eradication
        and the resulting potential impact on the availability of the information system is an organizational control outside
        the scope of OpenShift configuration.

- control_key: SI-3 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
       The customer is responsible for ensuring that their malicious code
       protection mechanisms are centrally managed. A successful control
       response will need to address that the planning, implementing,
       assessing, authorizing and monitoring of their malicious code
       protection mechanism is centered in one location.

- control_key: SI-3 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer is responsible for ensuring that they update their
        malicious code protection mechanisms automatically when new versions/
        definitions become available. A successful control response will need
        to address that the employed malicious code protection
        mechanisms definitions are configured to be updated automatically.

- control_key: SI-3 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into AC-6(10).

- control_key: SI-3 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-3(4) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-401

- control_key: SI-3 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-3 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-3 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer is responsible for ensuring that they implement a
        nonsignature-based malicious code detection mechanism on their
        information system. A successful control response will need to address
        a nonsignature based detection mechanism that can detect, analyze and
        describe the characteristics or behavior of malicious code and
        could provide safeguards against malicious code for which signatures
        do not yet exist.

- control_key: SI-3 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-3(4) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-530

- control_key: SI-3 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-3(4) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-531

- control_key: SI-3 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.1
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: a.2
      text: |
        Monitoring the system to detect unauthorized local, network, and remote connections
        is an organizational control outside the scope of OpenShift configuration.
        Functionality to meet this control can be provided by a third party vendor.
    - key: b
      text: |
        Identifying unauthorized use of the information system through organization-defined
        techniques and methods is an organizational control outside the scope
        of OpenShift configuration. Functionality to meet this control can be provided by a third party vendor.
    - key: c
      text: |
        Deploying monitoring devices is an organizational control outside the scope of OpenShift configuration.
        Functionality to meet this control can be provided by a third party vendor.
    - key: c.1
      text: |
        Deploying monitoring devices strategically within the information system to collect organization-determined
        essential information is an organizational control outside the scope of OpenShift configuration.
        Functionality to meet this control can be provided by a third party vendor.
    - key: c.2
      text: |
        Deploying monitoring devices at ad hoc locations within the system to track specific types of transactions
        of interest to the organization is an organizational control outside the scope of OpenShift configuration.
        Functionality to meet this control can be provided by a third party vendor.
    - key: d
      text: |
        Protecting information obtained from intrusion-monitoring tools from unauthorized access,
        modification, and deletion is an organizational control outside the scope of OpenShift configuration.
        Functionality to meet this control can be provided by a third party vendor.
    - key: e
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: f
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: g
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for integrating intrusion detection
        tools into the OpenShift environment, and documenting how this
        capability is integrated into enterprise-wide intrusion detection
        systems when applicable. A successful control response will address
        the workflow between local and enterprise intrusion detection
        systems.

- control_key: SI-4 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for deploying automated tools to
        support near real-time analysis of events in their infrastructure.
        This is frequently provided by corporate services outside the
        information system, e.g. centralized security operation centers may
        host an enterprise logging solution. A successful control response
        will indicate who is responsible for hosting such capabilities, and
        what technology and processes are in place to support near-realtime
        analysis of events.

- control_key: SI-4 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(3) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-533

- control_key: SI-4 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for identifying how and where
        network traffic is continuously monitored. Frequently this control
        is inherited from network and Infrastructure as a Service providers,
        such as Microsoft Azure. A successful control response will indicate
        if this control is inherited from infrastructure providers, and if
        not, how network traffic is continuously monitored.

- control_key: SI-4 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for automatic notification of
        appropriate staff when indicators of compromise are detected.
        Frequently this is accomplished by automatic alerting to Security
        Operations Center staff. A successful control response will indicate
        who is notified, by name or position title(s), and the mechanism of
        the notification.

- control_key: SI-4 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into AC-6(10).

- control_key: SI-4 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(7) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-535

- control_key: SI-4 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(9) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-536

- control_key: SI-4 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (14)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        An OpenShift infrastructure does not have wireless capabilities.

- control_key: SI-4 (15)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        An OpenShift infrastructure does not have wireless capabilities.

- control_key: SI-4 (16)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for aggregating and correlating
        information from monitoring tools, for multiple system components.
        This is frequently accomplished with centralized audit reduction
        tools.

        A control response for SI-4(16) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-536

- control_key: SI-4 (17)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (18)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(18) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-537

- control_key: SI-4 (19)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (20)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(20) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-538

- control_key: SI-4 (21)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-4 (22)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(20) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-539

- control_key: SI-4 (23)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for installing host-based monitoring
        mechanisms. A successful control response will need to discuss how
        various elements of the OpenShift infrastructure are monitored.

        A control response for SI-4(20) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-540

- control_key: SI-4 (24)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-4(20) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-541

- control_key: SI-5
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        A control response for SI-5(a) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-396
    - key: b
      text: |
        Receiving information system security alerts, advisories, and directives from
        organization-defined external organizations on an ongoing basis is an
        organizational procedures/policies outside the scope of OpenShift configuration.

        How to configure organization notifications for Red Hat security advisories on Red
        Hat specific products can be accomplished following the following documentation:

        https://access.redhat.com/security/updates/advisory
    - key: c
      text: |
        Disseminating security alerts, advisories, and directives to organization-defined
        personnel or roles, organization-defined elements within the organization,
        organization-defined external organizations are organizational
        procedures/policies outside the scope of OpenShift configuration.
    - key: d
      text: |
        Implementing security directives in accordance with established time frames or notifying
        the issuing organization of the degree of noncompliance is an organizational
        procedures/policies outside the scope of OpenShift configuration.

- control_key: SI-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-6
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        The customer will be responsible for verifying the correct operation
        of security functions within customer-controlled operating systems and
        software. A successful control response will need to discuss the
        security functions deemed necessary to verify, as well as the means
        for testing the correct operation and resolving any issues found.

        A control response for SI-6 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-542
    - key: b
      text: |
        The customer will be responsible for performing security function
        verification at customer-specified frequencies and under
        customer-specified circumstances (to include the requirements stated
        by FedRAMP). A successful control response will need to address the
        rationale for selection of the specific frequency and circumstances
        of security function verification.

        A control response for SI-6 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-542
    - key: c
      text: |
        The customer will be responsible for notifying appropriate personnel
        of failed security verification tests. A successful control response
        will need to outline the personnel or roles selected (to include
        system administrators and security personnel as required by FedRAMP).

        A control response for SI-6 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-542
    - key: d
      text: |
        The customer will be responsible for performing appropriate actions
        in response to anomalies in security unction verifiation. A successful
        control response will need to discuss the actions taken (to include
        notification of system administrators and security personnel as
        required by FedRAMP) as well as the rationale for selecting these
        actions.

        A control response for SI-6 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-542

- control_key: SI-6 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-6 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-6(2) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-543

- control_key: SI-6 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-6(3) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-544

- control_key: SI-7
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for employing integrity verification
        tools for customer-controlled operating systems and software. A
        successful control response will need to discuss the tools in use and
        the integrity-checking mechanisms these tools employ.

        A control response for SI-7 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-394

- control_key: SI-7 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for performing integrity checks at
        customer-specific frequencies and under customer-specified
        circumstances (including frequencies and circumstances specified by
        FedRAMP). A successful control response will need to identify the
        criteria for performing integrity checking, as well as the rationale
        for selecting those criteria.

        A control response for SI-7(1) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-395

- control_key: SI-7 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(2) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-545

- control_key: SI-7 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(4) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-546

- control_key: SI-7 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into AC-6(10).

- control_key: SI-7 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(5) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-547

- control_key: SI-7 (6)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(2) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-548

- control_key: SI-7 (7)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        The customer will be responsible for incorporating the detection of
        customer-defined security-relevant changes into the customers incident
        response capability. A successful control response will need to
        outline the process for deeming particular changes as
        security-relevant and the means by which the incident response
        capability is invoked when needed.

- control_key: SI-7 (8)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(8) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-549

- control_key: SI-7 (9)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(9) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-550

- control_key: SI-7 (10)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(10) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-551

- control_key: SI-7 (11)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-7 (12)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(12) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-552

- control_key: SI-7 (13)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-7 (14)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies, and is not
        applicable to the configuration of OpenShift.

- control_key: SI-7 (15)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(15) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-553

- control_key: SI-7 (16)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-7(16) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-554

- control_key: SI-8
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-8 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-8 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-8 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-9
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into AC-2,
        AC-3, AC-5 and AC-6.

- control_key: SI-10
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for checking the validity of
        information inputs to customer-controlled operating systems and
        software. A successful control response will need to discuss the
        specific inputs for which the validity is checked, the rationale
        for selecting those inputs for validity checking, and the response
        taken by the system to invalid inputs.

        A control response for SI-10 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-393

- control_key: SI-10 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.
    - key: d
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.
    - key: c
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-10 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-10(2) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-555

- control_key: SI-10 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-10(3) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-556

- control_key: SI-10 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-10(4) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-557

- control_key: SI-10 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-11
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: complete
  narrative:
    - key: a
      text: |
        In OpenShift, the logs depend greatly on the component. Some
        components would just write messages to stdout that the cluster
        administrator can retrieve logs through the use of the `oc` command.
        Some components emit events, and others emit a Prometheus metric which
        the API server would write into their logs.

        For the OCP components that run in a container (most operators),
        the usual RBAC rules would prevent a non-admin user from reading
        the container logs or events.

        OpenShift error message handling is designed to obscure or not log
        sensitive information such as passwords, credit card numbers, social
        security information, account information, etc.
    - key: b
      text: |
        By default, the API server logs are protected by UNIX permissions and
        only cluster administrators are allowed access to logs.

- control_key: SI-12
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        The customer will be responsible for handling and retaining
        information within, or hosted by, OpenShift in
        accordance with applicable federal laws, Executive Orders,
        directives, policies, regulations, standards, and operational
        requirements. A successful control response will need to outline
        the specific requirements applicable to customer information
        handling and retention, and the means by which those requirements
        are met.

- control_key: SI-13
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - key: a
      text: |
        A control response for SI-13(a) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-558
    - key: b
      text: |
        A control response for SI-13(b) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-558

- control_key: SI-13 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-13 (2)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        This control was withdrawn by NIST, and incorporated into SI-7(16).

- control_key: SI-13 (3)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-13(3) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-559

- control_key: SI-13 (4)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - key: a
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.
    - key: b
      text: |
        This control reflects organizational procedures/policies that
        are not applicable to the configuration of OpenShift.

- control_key: SI-13 (5)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-13(5) is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-560

- control_key: SI-14
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-15 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-561

- control_key: SI-14 (1)
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-15 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-562

- control_key: SI-15
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-15 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-563

- control_key: SI-16
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: not applicable
  narrative:
    - text: |
        Red Hat OpenShift Container Platform inherits memory protections
        provided by the underlying operating system. This control is not
        applicable to Red Hat OpenShift Container Platform.

- control_key: SI-17
  standard_key: NIST-800-53
  covered_by: []
  implementation_status: planned
  narrative:
    - text: |
        A control response for SI-17 is planned. Engineering progress can be
        tracked via:

        https://issues.redhat.com/browse/CMP-390