diff --git a/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml b/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml index c476f9b5..4e5d0089 100644 --- a/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml +++ b/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml @@ -1,4 +1,4 @@ - + Electronic Version of NIST SP 800-53 Rev 5.1.1 Controls and SP 800-53A Rev 5.1.1 Assessment Procedures 2024-01-18T22:10:00.000000-00:00 @@ -12,7 +12,7 @@ 1.1.1 -

This OSCAL version of the SP 800-53 Revision 5.1.1 catalog restores the props/@name="labels". The SP 800-53 Revision 5.1.1 catalog includes one new control (IA-13) and three control enhancements, minor grammatical edits/clarifications that do not impact the implementation or outcome of the controls and introduces “leading 0s” to the control identifiers. A list of updates in Release 5.1.1 is available under [Supplemental Material](includes one new control (IA-13) and three control enhancements, minor grammatical edits/clarifications that do not impact the implementation or outcome of the controls and introduces “leading 0s” to the control identifiers.

+

This OSCAL version of the SP 800-53 Revision 5.1.1 catalog restores the non-padded prop/@name="label" for all controls, for backwards compatibility and adds prop/@name="label" with class="zero-padded" to support and encourage users' transission to zero-padded control IDs. This SP 800-53 Revision 5.1.1 catalog preserves all content changes of the previous 5.1.1+u3 release: one new control (IA-13), three control enhancements, minor grammatical edits/clarifications that do not impact the implementation or outcome of the controls and introduces “leading 0s” to the control identifiers.

 @@ -148,7 +148,7 @@

events that would require procedures to be reviewed and updated are defined;

- + @@ -420,7 +420,7 @@

the frequency of account review is defined;

- + @@ -763,7 +763,7 @@

automated mechanisms used to support the management of system accounts are defined;

- + @@ -830,7 +830,7 @@

the time period after which to automatically remove or disable temporary or emergency accounts is defined;

- + @@ -898,7 +898,7 @@

time period for account inactivity before disabling is defined;

- + @@ -986,7 +986,7 @@ Automated Audit Actions - + @@ -1070,7 +1070,7 @@

the time period of expected inactivity or description of when to log out is defined;

- + @@ -1124,7 +1124,7 @@

dynamic privilege management capabilities are defined;

- + @@ -1184,7 +1184,7 @@ an attribute-based access scheme - + @@ -1280,7 +1280,7 @@

system accounts that are dynamically created, activated, managed, and deactivated are defined;

- + @@ -1360,7 +1360,7 @@

conditions for establishing shared and group accounts are defined;

- + @@ -1410,7 +1410,7 @@ Shared and Group Account Credential Change - + @@ -1435,7 +1435,7 @@

system accounts subject to enforcement of circumstances and/or usage conditions are defined;

- + @@ -1502,7 +1502,7 @@

personnel or roles to report atypical usage is/are defined;

- + @@ -1593,7 +1593,7 @@

significant risks leading to disabling accounts are defined;

- + @@ -1647,7 +1647,7 @@ Access Enforcement - + @@ -1749,7 +1749,7 @@ Restricted Access to Privileged Functions - + @@ -1767,7 +1767,7 @@

privileged commands and/or other actions requiring dual authorization are defined;

- + @@ -1856,7 +1856,7 @@

privileges to be explicitly granted to subjects are defined;

- + @@ -2018,7 +2018,7 @@

discretionary access control policy enforced over the set of covered objects is defined;

- + @@ -2132,7 +2132,7 @@

security-relevant information to which access is prevented except during secure, non-operable system states is defined;

- + @@ -2184,7 +2184,7 @@ Protection of User and System Information - + @@ -2213,7 +2213,7 @@

users authorized to assume roles (defined in AC-03(07)_ODP[01]) are defined;

- + @@ -2290,7 +2290,7 @@

rules governing the timing of revocations of access authorizations are defined;

- + @@ -2374,7 +2374,7 @@

controls used to validate appropriateness of information to be released are defined;

- + @@ -2473,7 +2473,7 @@

roles allowed to employ an audited override of automated access control mechanisms are defined;

- + @@ -2536,7 +2536,7 @@

information types requiring restricted access to data repositories are defined;

- + @@ -2598,7 +2598,7 @@

system applications and functions requiring access assertion are defined;

- + @@ -2682,7 +2682,7 @@

attributes to assume access permissions are defined;

- + @@ -2762,7 +2762,7 @@

elements of personally identifiable information to which individuals have access are defined;

- + @@ -2861,7 +2861,7 @@

a discretionary access control policy enforced over the set of covered objects specified in the policy is defined;

- + @@ -2959,7 +2959,7 @@

information flow control policies within the system and between connected systems are defined;

- + @@ -3113,7 +3113,7 @@

information flow control policies as a basis for enforcement of flow control decisions are defined;

- + @@ -3183,7 +3183,7 @@

information flow control policies to be enforced by use of protected processing domains are defined;

- + @@ -3242,7 +3242,7 @@

information flow control policies to be enforced are defined;

- + @@ -3321,7 +3321,7 @@

the organization-defined procedure or method used to prevent encrypted information from bypassing information flow control mechanisms is defined (if selected);

- + @@ -3380,7 +3380,7 @@

limitations on embedding data types within other data types are defined;

- + @@ -3438,7 +3438,7 @@

metadata on which to base enforcement of information flow control is defined;

- + @@ -3491,7 +3491,7 @@ One-way Flow Mechanisms - + @@ -3609,7 +3609,7 @@

privacy policy identifying actions to be taken after a filter processing failure are defined;

- + @@ -3705,7 +3705,7 @@

conditions under which the use of human reviews for information flows are to be enforced are defined;

- + @@ -3799,7 +3799,7 @@

conditions under which privileged administrators have the capability to enable and disable privacy policy filters are defined;

- + @@ -3883,7 +3883,7 @@

privacy policy filters that privileged administrators have the capability to configure to support different security and privacy policies are defined;

- + @@ -3955,7 +3955,7 @@

data type identifiers to be used to validate data essential for information flow decisions are defined;

- + @@ -4014,7 +4014,7 @@

policy-relevant subcomponents into which to decompose information for submission to policy enforcement mechanisms are defined;

- + @@ -4083,7 +4083,7 @@

privacy policy filters to be implemented that require fully enumerated formats restricting data structure and content are defined;

- + @@ -4174,7 +4174,7 @@

privacy policy that requires the transfer of organization-defined unsanctioned information between different security domains to be prohibited is defined (if selected);

- + @@ -4241,7 +4241,7 @@ Information Transfers on Interconnected Systems - + @@ -4257,7 +4257,7 @@ organization, system, application, service, individual - + @@ -4313,7 +4313,7 @@ Security Attribute Binding - + @@ -4341,7 +4341,7 @@

privacy policy filters to be implemented on metadata are defined (if selected);

- + @@ -4421,7 +4421,7 @@

information to be controlled when it flows across security domains is defined;

- + @@ -4501,7 +4501,7 @@

required separations by types of information are defined;

- + @@ -4565,7 +4565,7 @@ Access Only - + @@ -4622,7 +4622,7 @@

modification action implemented on non-releasable information is defined;

- + @@ -4672,7 +4672,7 @@ Internal Normalized Format - + @@ -4746,7 +4746,7 @@

policy for sanitizing data is defined;

- + @@ -4796,7 +4796,7 @@ Audit Filtering Actions - + @@ -4860,7 +4860,7 @@ Redundant/Independent Filtering Mechanisms - + @@ -4909,7 +4909,7 @@ Linear Filter Pipelines - + @@ -4967,7 +4967,7 @@

policy for content-filtering actions is defined;

- + @@ -5044,7 +5044,7 @@ Filter Mechanisms Using Multiple Processes - + @@ -5094,7 +5094,7 @@ Failed Content Transfer Prevention - + @@ -5143,7 +5143,7 @@ Process Requirements for Information Transfer - + @@ -5238,7 +5238,7 @@

duties of individuals requiring separation are defined;

- + @@ -5319,7 +5319,7 @@ Least Privilege - + @@ -5422,7 +5422,7 @@

security-relevant information for authorized access is defined;

- + @@ -5515,7 +5515,7 @@

security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions, are defined;

- + @@ -5584,7 +5584,7 @@

compelling operational needs necessitating network access to privileged commands are defined;

- + @@ -5644,7 +5644,7 @@ Separate Processing Domains - + @@ -5708,7 +5708,7 @@

personnel or roles to which privileged accounts on the system are to be restricted is/are defined;

- + @@ -5761,7 +5761,7 @@ Privileged Access by Non-organizational Users - + @@ -5832,7 +5832,7 @@

roles or classes of users to which privileges are assigned are defined;

- + @@ -5909,7 +5909,7 @@

software to be prevented from executing at higher privilege levels than users executing the software is defined;

- + @@ -5960,7 +5960,7 @@ Log Use of Privileged Functions - + @@ -6015,7 +6015,7 @@ Prohibit Non-privileged Users from Executing Privileged Functions - + @@ -6117,7 +6117,7 @@

other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined (if selected);

- + @@ -6187,7 +6187,7 @@ Automatic Account Lock - + @@ -6221,7 +6221,7 @@

the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined;

- + @@ -6282,7 +6282,7 @@

the number of unsuccessful biometric logon attempts is defined;

- + @@ -6355,7 +6355,7 @@

time period during which a user can attempt logons through alternative factors is defined;

- + @@ -6439,7 +6439,7 @@

conditions for system use to be displayed by the system before granting further access are defined;

- + @@ -6585,7 +6585,7 @@ Previous Logon Notification - + @@ -6634,7 +6634,7 @@ Unsuccessful Logons - + @@ -6700,7 +6700,7 @@

the time period for which the system notifies the user of the number of successful logons, unsuccessful logon attempts, or both is defined;

- + @@ -6766,7 +6766,7 @@

the time period for which the system notifies the user of changes to security-related characteristics or parameters of the user’s account is defined;

- + @@ -6823,7 +6823,7 @@

additional information about which to notify the user is defined;

- + @@ -6890,7 +6890,7 @@

the number of concurrent sessions to be allowed for each account and/or account type is defined;

- + @@ -6955,7 +6955,7 @@

time period of inactivity after which a device lock is initiated is defined (if selected);

- + @@ -7023,7 +7023,7 @@ Pattern-hiding Displays - + @@ -7082,7 +7082,7 @@

conditions or trigger events requiring session disconnect are defined;

- + @@ -7141,7 +7141,7 @@

information resources for which a logout capability for user-initiated communications sessions is required are defined;

- + @@ -7193,7 +7193,7 @@ Termination Message - + @@ -7253,7 +7253,7 @@

time until the end of session for display to users is defined;

- + @@ -7305,7 +7305,7 @@ Supervision and Review — Access Control - + @@ -7323,7 +7323,7 @@

user actions that can be performed on the system without identification or authentication are defined;

- + @@ -7391,7 +7391,7 @@ Necessary Uses - + @@ -7401,7 +7401,7 @@ Automated Marking - + @@ -7519,7 +7519,7 @@

the frequency at which to review privacy attributes for applicability is defined;

- + @@ -7732,7 +7732,7 @@

privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined;

- + @@ -7801,7 +7801,7 @@ Attribute Value Changes by Authorized Individuals - + @@ -7915,7 +7915,7 @@

objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined;

- + @@ -8053,7 +8053,7 @@

objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined;

- + @@ -8142,7 +8142,7 @@

human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined;

- + @@ -8291,7 +8291,7 @@

privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects;

- + @@ -8357,7 +8357,7 @@ Consistent Attribute Interpretation - + @@ -8437,7 +8437,7 @@

techniques and technologies to be implemented in associating privacy attributes to information are defined;

- + @@ -8517,7 +8517,7 @@

techniques or procedures used to validate regrading mechanisms for privacy attributes are defined;

- + @@ -8576,7 +8576,7 @@ Attribute Configuration by Authorized Individuals - + @@ -8636,7 +8636,7 @@ Remote Access - + @@ -8739,7 +8739,7 @@ Monitoring and Control - + @@ -8803,7 +8803,7 @@ Protection of Confidentiality and Integrity Using Encryption - + @@ -8856,7 +8856,7 @@ Managed Access Control Points - + @@ -8925,7 +8925,7 @@

needs requiring access to security-relevant information via remote access are defined;

- + @@ -9011,7 +9011,7 @@ Monitoring for Unauthorized Connections - + @@ -9020,7 +9020,7 @@ Protection of Mechanism Information - + @@ -9062,7 +9062,7 @@ Additional Protection for Security Function Access - + @@ -9071,7 +9071,7 @@ Disable Nonsecure Network Protocols - + @@ -9088,7 +9088,7 @@

the time period within which to disconnect or disable remote access to the system is defined;

- + @@ -9153,7 +9153,7 @@

remote commands to be authenticated by mechanisms are defined;

- + @@ -9206,7 +9206,7 @@ Wireless Access - + @@ -9307,7 +9307,7 @@ devices - + @@ -9368,7 +9368,7 @@ Monitoring Unauthorized Connections - + @@ -9377,7 +9377,7 @@ Disable Wireless Networking - + @@ -9426,7 +9426,7 @@ Restrict Configurations by Users - + @@ -9485,7 +9485,7 @@ Antennas and Transmission Power Levels - + @@ -9546,7 +9546,7 @@ Access Control for Mobile Devices - + @@ -9652,7 +9652,7 @@ Use of Writable and Portable Storage Devices - + @@ -9661,7 +9661,7 @@ Use of Personally Owned Portable Storage Devices - + @@ -9670,7 +9670,7 @@ Use of Portable Storage Devices with No Identifiable Owner - + @@ -9695,7 +9695,7 @@

security policies restricting the connection of classified mobile devices to classified systems are defined;

- + @@ -9835,7 +9835,7 @@

mobile devices on which to employ encryption are defined;

- + @@ -9923,7 +9923,7 @@

types of external systems prohibited from use are defined;

- + @@ -10018,7 +10018,7 @@ Limits on Authorized Use - + @@ -10091,7 +10091,7 @@

restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems are defined;

- + @@ -10150,7 +10150,7 @@

restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit organizational information are defined;

- + @@ -10208,7 +10208,7 @@

network-accessible storage devices prohibited from use in external systems are defined;

- + @@ -10259,7 +10259,7 @@ Portable Storage Devices — Prohibited Use - + @@ -10325,7 +10325,7 @@

automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined;

- + @@ -10413,7 +10413,7 @@

automated mechanisms employed to enforce information-sharing decisions by authorized users are defined;

- + @@ -10473,7 +10473,7 @@

information-sharing restrictions to be enforced by information search and retrieval services are defined;

- + @@ -10534,7 +10534,7 @@

the frequency at which to review the content on the publicly accessible system for non-public information is defined;

- + @@ -10649,7 +10649,7 @@

data storage objects to be protected against unauthorized data mining are defined;

- + @@ -10726,7 +10726,7 @@

access control decisions applied to each access request prior to access enforcement are defined;

- + @@ -10800,7 +10800,7 @@

systems that enforce access control decisions are defined;

- + @@ -10870,7 +10870,7 @@

privacy attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected);

- + @@ -10939,7 +10939,7 @@

access control policies for which a reference monitor is implemented are defined;

- + @@ -11068,7 +11068,7 @@

events that would require procedures to be reviewed and updated are defined;

- + @@ -11320,7 +11320,7 @@

events that would require literacy training and awareness content to be updated are defined;

- + @@ -11481,7 +11481,7 @@ Practical Exercises - + @@ -11535,7 +11535,7 @@ Insider Threat - + @@ -11588,7 +11588,7 @@ Social Engineering and Mining - + @@ -11658,7 +11658,7 @@

indicators of malicious code are defined;

- + @@ -11701,7 +11701,7 @@ Advanced Persistent Threat - + @@ -11744,7 +11744,7 @@ Cyber Threat Environment - + @@ -11848,7 +11848,7 @@

events that require role-based training content to be updated are defined;

- + @@ -12018,7 +12018,7 @@

the frequency at which to provide refresher training in the employment and operation of environmental controls is defined;

- + @@ -12082,7 +12082,7 @@

the frequency at which to provide refresher training in the employment and operation of physical security controls is defined;

- + @@ -12128,7 +12128,7 @@ Practical Exercises - + @@ -12180,7 +12180,7 @@ Suspicious Communications and Anomalous System Behavior - + @@ -12205,7 +12205,7 @@

the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined;

- + @@ -12267,7 +12267,7 @@

time period for retaining individual training records is defined;

- + @@ -12345,7 +12345,7 @@ Contacts with Security Groups and Associations - + @@ -12370,7 +12370,7 @@

personnel to whom feedback on organizational training results will be provided is/are assigned;

- + @@ -12486,7 +12486,7 @@

events that would require audit and accountability procedures to be reviewed and updated are defined;

- + @@ -12710,7 +12710,7 @@

the frequency of event types selected for logging are reviewed and updated;

- + @@ -12849,7 +12849,7 @@ Compilation of Audit Records from Multiple Sources - + @@ -12858,7 +12858,7 @@ Selection of Audit Events by Component - + @@ -12867,7 +12867,7 @@ Reviews and Updates - + @@ -12876,7 +12876,7 @@ Privileged Functions - + @@ -12886,7 +12886,7 @@ Content of Audit Records - + @@ -13008,7 +13008,7 @@

additional information to be included in audit records is defined;

- + @@ -13060,7 +13060,7 @@ Centralized Management of Planned Audit Record Content - + @@ -13077,7 +13077,7 @@

elements identified in the privacy risk assessment are defined;

- + @@ -13142,7 +13142,7 @@

audit log retention requirements are defined;

- + @@ -13211,7 +13211,7 @@

the frequency of audit logs transferred to a different system, system component, or media other than the system or system component conducting the logging is defined;

- + @@ -13289,7 +13289,7 @@

additional actions to be taken in the event of an audit logging process failure are defined;

- + @@ -13388,7 +13388,7 @@

percentage of repository maximum audit log storage capacity is defined;

- + @@ -13462,7 +13462,7 @@

audit logging failure events requiring real-time alerts are defined;

- + @@ -13514,7 +13514,7 @@ delay - + @@ -13584,7 +13584,7 @@

audit logging failures that trigger a change in operational mode are defined;

- + @@ -13644,7 +13644,7 @@

an alternate audit logging functionality in the event of a failure in primary audit logging capability is defined;

- + @@ -13721,7 +13721,7 @@

personnel or roles to receive findings from reviews and analyses of system records is/are defined;

- + @@ -13826,7 +13826,7 @@

automated mechanisms used for integrating audit record review, analysis, and reporting processes are defined;

- + @@ -13878,7 +13878,7 @@ Automated Security Alerts - + @@ -13887,7 +13887,7 @@ Correlate Audit Record Repositories - + @@ -13939,7 +13939,7 @@ Central Review and Analysis - + @@ -14019,7 +14019,7 @@

data/information collected from other sources to be analyzed is defined (if selected);

- + @@ -14071,7 +14071,7 @@ Correlation with Physical Monitoring - + @@ -14132,7 +14132,7 @@ user - + @@ -14179,7 +14179,7 @@ Full Text Analysis of Privileged Commands - + @@ -14234,7 +14234,7 @@ Correlation with Information from Nontechnical Sources - + @@ -14286,7 +14286,7 @@ Audit Level Adjustment - + @@ -14296,7 +14296,7 @@ Audit Record Reduction and Report Generation - + @@ -14401,7 +14401,7 @@

fields within audit records that can be processed, sorted, or searched are defined;

- + @@ -14463,7 +14463,7 @@ Automatic Sort and Search - + @@ -14481,7 +14481,7 @@

granularity of time measurement for audit record timestamps is defined;

- + @@ -14549,7 +14549,7 @@ Synchronization with Authoritative Time Source - + @@ -14558,7 +14558,7 @@ Secondary Authoritative Time Source - + @@ -14576,7 +14576,7 @@

personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information is/are defined;

- + @@ -14660,7 +14660,7 @@ Hardware Write-once Media - + @@ -14724,7 +14724,7 @@

the frequency of storing audit records in a repository is defined;

- + @@ -14778,7 +14778,7 @@ Cryptographic Protection - + @@ -14842,7 +14842,7 @@

a subset of privileged users or roles authorized to access management of audit logging functionality is defined;

- + @@ -14913,7 +14913,7 @@

audit information for which dual authorization is to be enforced is defined;

- + @@ -14975,7 +14975,7 @@

a subset of privileged users or roles with authorized read-only access to audit information is defined;

- + @@ -15030,7 +15030,7 @@ Store on Component with Different Operating System - + @@ -15096,7 +15096,7 @@

actions to be covered by non-repudiation are defined;

- + @@ -15167,7 +15167,7 @@

the strength of binding between the identity of the information producer and the information is defined;

- + @@ -15252,7 +15252,7 @@

the actions to be performed in the event of a validation error are defined;

- + @@ -15323,7 +15323,7 @@ Chain of Custody - + @@ -15394,7 +15394,7 @@

actions to be performed in the event of a validation error are defined;

- + @@ -15464,7 +15464,7 @@ Digital Signatures - + @@ -15483,7 +15483,7 @@

a time period to retain audit records that is consistent with the records retention policy is defined;

- + @@ -15544,7 +15544,7 @@

measures to be employed to ensure that long-term audit records generated by the system can be retrieved are defined;

- + @@ -15614,7 +15614,7 @@

personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined;

- + @@ -15725,7 +15725,7 @@

level of tolerance for the relationship between timestamps of individual records in the audit trail is defined;

- + @@ -15779,7 +15779,7 @@ Standardized Formats - + @@ -15863,7 +15863,7 @@

time thresholds in which logging actions are to change is defined;

- + @@ -15925,7 +15925,7 @@ Query Parameter Audits of Personally Identifiable Information - + @@ -16020,7 +16020,7 @@

additional actions to be taken if an information disclosure is discovered are defined;

- + @@ -16116,7 +16116,7 @@

automated mechanisms for monitoring open-source information and information sites are defined;

- + @@ -16176,7 +16176,7 @@

the frequency at which to review the open-source information sites being monitored is defined;

- + @@ -16227,7 +16227,7 @@ Unauthorized Replication of Information - + @@ -16307,7 +16307,7 @@

circumstances under which the content of a user session can be audited are defined;

- + @@ -16407,7 +16407,7 @@ System Start-up - + @@ -16458,7 +16458,7 @@ Capture and Record Content - + @@ -16467,7 +16467,7 @@ Remote Viewing and Listening - + @@ -16531,7 +16531,7 @@ Alternate Audit Logging Capability - + @@ -16556,7 +16556,7 @@

audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries is defined;

- + @@ -16608,7 +16608,7 @@ Identity Preservation - + @@ -16677,7 +16677,7 @@

cross-organizational sharing agreements to be used when providing cross-organizational audit information to organizations are defined;

- + @@ -16727,7 +16727,7 @@

measures to disassociate individuals from audit information transmitted across organizational boundaries are defined;

- + @@ -16849,7 +16849,7 @@

events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;

- + @@ -17060,7 +17060,7 @@

individuals or roles to whom control assessment results are to be provided are defined;

- + @@ -17236,7 +17236,7 @@ Independent Assessors - + @@ -17322,7 +17322,7 @@

other forms of assessment are defined (if selected);

- + @@ -17399,7 +17399,7 @@

requirements to be met by the control assessment performed by an external organization on the system are defined;

- + @@ -17476,7 +17476,7 @@

the frequency at which to review and update agreements is defined;

- + @@ -17595,7 +17595,7 @@ Unclassified National Security System Connections - + @@ -17604,7 +17604,7 @@ Classified National Security System Connections - + @@ -17613,7 +17613,7 @@ Unclassified Non-national Security System Connections - + @@ -17622,7 +17622,7 @@ Connections to Public Networks - + @@ -17631,7 +17631,7 @@ Restrictions on External System Connections - + @@ -17640,7 +17640,7 @@ Transfer Authorizations - + @@ -17702,7 +17702,7 @@ Transitive Information Exchanges - + @@ -17779,7 +17779,7 @@ Security Certification - + @@ -17796,7 +17796,7 @@

the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities is defined;

- + @@ -17878,7 +17878,7 @@

automated mechanisms used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system are defined;

- + @@ -17938,7 +17938,7 @@

frequency at which to update the authorizations is defined;

- + @@ -18055,7 +18055,7 @@ Joint Authorization — Intra-organization - + @@ -18115,7 +18115,7 @@ Joint Authorization — Inter-organization - + @@ -18238,7 +18238,7 @@

frequency at which the privacy status of the system is reported is defined;

- + @@ -18445,7 +18445,7 @@ Independent Assessment - + @@ -18492,7 +18492,7 @@ Types of Assessments - + @@ -18501,7 +18501,7 @@ Trend Analyses - + @@ -18570,7 +18570,7 @@ Risk Monitoring - + @@ -18671,7 +18671,7 @@

actions to validate that implemented controls are operating in a consistent manner are defined;

- + @@ -18741,7 +18741,7 @@

automated mechanisms used to ensure the accuracy, currency, and availability of monitoring results for the system are defined;

- + @@ -18814,7 +18814,7 @@

systems or system components on which penetration testing is to be conducted are defined;

- + @@ -18870,7 +18870,7 @@ Independent Penetration Testing Agent or Team - + @@ -18923,7 +18923,7 @@

red team exercises to simulate attempts by adversaries to compromise organizational systems are defined;

- + @@ -18994,7 +18994,7 @@ unannounced - + @@ -19077,7 +19077,7 @@

frequency at which to review the continued need for each internal connection is defined;

- + @@ -19192,7 +19192,7 @@ Compliance Checks - + @@ -19329,7 +19329,7 @@

events that would require configuration management procedures to be reviewed and updated are defined;

- + @@ -19539,7 +19539,7 @@

the circumstances requiring baseline configuration review and update are defined;

- + @@ -19665,7 +19665,7 @@ Reviews and Updates - + @@ -19682,7 +19682,7 @@

automated mechanisms for maintaining baseline configuration of the system are defined;

- + @@ -19766,7 +19766,7 @@

the number of previous baseline configuration versions to be retained is defined;

- + @@ -19817,7 +19817,7 @@ Unauthorized Software - + @@ -19826,7 +19826,7 @@ Authorized Software - + @@ -19835,7 +19835,7 @@ Development and Test Environments - + @@ -19923,7 +19923,7 @@

the controls to be applied when the individuals return from travel are defined;

- + @@ -20037,7 +20037,7 @@

configuration change conditions that prompt the configuration control element to convene are defined (if selected);

- + @@ -20239,7 +20239,7 @@

personnel to be notified when approved changes are complete is/are defined;

- + @@ -20351,7 +20351,7 @@ Testing, Validation, and Documentation of Changes - + @@ -20431,7 +20431,7 @@

mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined;

- + @@ -20523,7 +20523,7 @@

the configuration change control element of which the security and privacy representatives are to be members is defined;

- + @@ -20588,7 +20588,7 @@

security responses to be automatically implemented are defined;

- + @@ -20651,7 +20651,7 @@

controls provided by cryptographic mechanisms that are to be under configuration management are defined;

- + @@ -20721,7 +20721,7 @@

the circumstances under which changes are to be reviewed are defined;

- + @@ -20786,7 +20786,7 @@

the circumstances under which changes are to be prevented or restricted are defined;

- + @@ -20823,7 +20823,7 @@ Impact Analyses - + @@ -20904,7 +20904,7 @@ Separate Test Environments - + @@ -21012,7 +21012,7 @@ Verification of Controls - + @@ -21105,7 +21105,7 @@ Access Restrictions for Change - + @@ -21209,7 +21209,7 @@

mechanisms used to automate the enforcement of access restrictions are defined;

- + @@ -21286,7 +21286,7 @@ Review System Changes - + @@ -21295,7 +21295,7 @@ Signed Components - + @@ -21323,7 +21323,7 @@

system-level information requiring dual authorization for changes is defined;

- + @@ -21410,7 +21410,7 @@

frequency at which to reevaluate privileges is defined;

- + @@ -21500,7 +21500,7 @@ Limit Library Privileges - + @@ -21555,7 +21555,7 @@ Automatic Implementation of Security Safeguards - + @@ -21589,7 +21589,7 @@

operational requirements necessitating approval of deviations are defined;

- + @@ -21770,7 +21770,7 @@

automated mechanisms to verify configuration settings are defined;

- + @@ -21857,7 +21857,7 @@

configuration settings requiring action upon an unauthorized change are defined;

- + @@ -21916,7 +21916,7 @@ Unauthorized Change Detection - + @@ -21925,7 +21925,7 @@ Conformance Demonstration - + @@ -21987,7 +21987,7 @@

services to be prohibited or restricted are defined;

- + @@ -22152,7 +22152,7 @@

services to be disabled or removed when deemed unnecessary or non-secure are defined;

- + @@ -22265,7 +22265,7 @@

policies, rules of behavior, and/or access agreements regarding software program usage and restrictions are defined (if selected);

- + @@ -22336,7 +22336,7 @@

registration requirements for functions, ports, protocols, and services are defined;

- + @@ -22405,7 +22405,7 @@

frequency at which to review and update the list of unauthorized software programs is defined;

- + @@ -22510,7 +22510,7 @@

frequency at which to review and update the list of authorized software programs is defined;

- + @@ -22610,7 +22610,7 @@

user-installed software required to be executed in a confined environment is defined;

- + @@ -22676,7 +22676,7 @@

personnel or roles to explicitly approve execution of binary or machine-executable code is/are defined;

- + @@ -22755,7 +22755,7 @@ Binary or Machine Executable Code - + @@ -22858,7 +22858,7 @@

frequency at which to review and update the list of authorized hardware components is defined;

- + @@ -22955,7 +22955,7 @@

frequency at which to review and update the system component inventory is defined;

- + @@ -23091,7 +23091,7 @@ Updates During Installation and Removal - + @@ -23196,7 +23196,7 @@

automated mechanisms used to maintain the availability of the system component inventory are defined;

- + @@ -23323,7 +23323,7 @@

personnel or roles to be notified when unauthorized components are detected is/are defined (if selected);

- + @@ -23446,7 +23446,7 @@ role - + @@ -23498,7 +23498,7 @@ No Duplicate Accounting of Components - + @@ -23507,7 +23507,7 @@ Assessed Configurations and Approved Deviations - + @@ -23571,7 +23571,7 @@ Centralized Repository - + @@ -23633,7 +23633,7 @@

automated mechanisms for tracking components are defined;

- + @@ -23697,7 +23697,7 @@

personnel or roles from which to receive an acknowledgement is/are defined;

- + @@ -23779,7 +23779,7 @@

personnel or roles to review and approve the configuration management plan is/are defined;

- + @@ -23940,7 +23940,7 @@ Assignment of Responsibility - + @@ -23981,7 +23981,7 @@ Software Usage Restrictions - + @@ -24074,7 +24074,7 @@

restrictions on the use of open-source software are defined;

- + @@ -24156,7 +24156,7 @@

frequency with which to monitor compliance is defined;

- + @@ -24248,7 +24248,7 @@ Alerts for Unauthorized Installations - + @@ -24257,7 +24257,7 @@ Software Installation with Privileged Status - + @@ -24333,7 +24333,7 @@

automated mechanisms used to monitor compliance are defined;

- + @@ -24410,7 +24410,7 @@

information for which the location is to be identified and documented is defined;

- + @@ -24560,7 +24560,7 @@

system components where the information is located are defined;

- + @@ -24618,7 +24618,7 @@ Data Action Mapping - + @@ -24702,7 +24702,7 @@

firmware components requiring verification of a digitally signed certificate before installation are defined;

- + @@ -24843,7 +24843,7 @@

events that would require procedures to be reviewed and updated are defined;

- + @@ -25098,7 +25098,7 @@

key contingency organizational elements to communicate changes to are defined;

- + @@ -25388,7 +25388,7 @@ Coordinate with Related Plans - + @@ -25436,7 +25436,7 @@ Capacity Planning - + @@ -25513,7 +25513,7 @@

the contingency plan activation time period within which to resume mission and business functions is defined;

- + @@ -25564,7 +25564,7 @@ Resume All Mission and Business Functions - + @@ -25581,7 +25581,7 @@ essential - + @@ -25652,7 +25652,7 @@ essential - + @@ -25713,7 +25713,7 @@ Coordinate with External Service Providers - + @@ -25766,7 +25766,7 @@ essential - + @@ -25842,7 +25842,7 @@

events necessitating review and update of contingency training are defined;

- + @@ -25951,7 +25951,7 @@ Simulated Events - + @@ -26001,7 +26001,7 @@ Mechanisms Used in Training Environments - + @@ -26079,7 +26079,7 @@

tests for determining readiness to execute the contingency plan are defined;

- + @@ -26180,7 +26180,7 @@ Coordinate with Related Plans - + @@ -26232,7 +26232,7 @@ Alternate Processing Site - + @@ -26310,7 +26310,7 @@

automated mechanisms for contingency plan testing are defined;

- + @@ -26361,7 +26361,7 @@ Full Recovery and Reconstitution - + @@ -26440,7 +26440,7 @@

system or system component on which to apply disruption mechanisms are defined;

- + @@ -26493,7 +26493,7 @@ Contingency Plan Update - + @@ -26502,7 +26502,7 @@ Alternate Storage Site - + @@ -26586,7 +26586,7 @@ Separation from Primary Site - + @@ -26630,7 +26630,7 @@ Recovery Time and Recovery Point Objectives - + @@ -26690,7 +26690,7 @@ Accessibility - + @@ -26762,7 +26762,7 @@

time period consistent with recovery time and recovery point objectives is defined;

- + @@ -26859,7 +26859,7 @@ Separation from Primary Site - + @@ -26903,7 +26903,7 @@ Accessibility - + @@ -26956,7 +26956,7 @@ Priority of Service - + @@ -26999,7 +26999,7 @@ Preparation for Use - + @@ -27052,7 +27052,7 @@ Equivalent Information Security Safeguards - + @@ -27061,7 +27061,7 @@ Inability to Return to Primary Site - + @@ -27129,7 +27129,7 @@

time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined;

- + @@ -27183,7 +27183,7 @@ Priority of Service Provisions - + @@ -27258,7 +27258,7 @@ Single Points of Failure - + @@ -27300,7 +27300,7 @@ Separation of Primary and Alternate Providers - + @@ -27362,7 +27362,7 @@

frequency at which to obtain evidence of contingency training by providers is defined;

- + @@ -27459,7 +27459,7 @@

frequency at which alternate telecommunications services are tested is defined;

- + @@ -27545,7 +27545,7 @@

frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined;

- + @@ -27675,7 +27675,7 @@

frequency at which to test backup information for information integrity is defined;

- + @@ -27735,7 +27735,7 @@ Test Restoration Using Sampling - + @@ -27795,7 +27795,7 @@

critical system software and other security-related information backups to be stored in a separate facility are defined;

- + @@ -27841,7 +27841,7 @@ Protection from Unauthorized Modification - + @@ -27869,7 +27869,7 @@

transfer rate consistent with recovery time and recovery point objectives is defined;

- + @@ -27933,7 +27933,7 @@ Redundant Secondary System - + @@ -28005,7 +28005,7 @@

backup information for which to enforce dual authorization in order to delete or destroy is defined;

- + @@ -28067,7 +28067,7 @@

backup information to protect against unauthorized disclosure and modification is defined;

- + @@ -28138,7 +28138,7 @@

time period consistent with recovery time and recovery point objectives for the reconstitution of the system is determined;

- + @@ -28207,7 +28207,7 @@ Contingency Plan Testing - + @@ -28216,7 +28216,7 @@ Transaction Recovery - + @@ -28268,7 +28268,7 @@ Compensating Security Controls - + @@ -28287,7 +28287,7 @@

restoration time period within which to restore system components to a known, operational state is defined;

- + @@ -28340,7 +28340,7 @@ Failover Capability - + @@ -28349,7 +28349,7 @@ Component Protection - + @@ -28417,7 +28417,7 @@

alternative communications protocols in support of maintaining continuity of operations are defined;

- + @@ -28489,7 +28489,7 @@

conditions detected to enter a safe mode of operation are defined;

- + @@ -28566,7 +28566,7 @@

security functions are defined;

- + @@ -28691,7 +28691,7 @@

events that would require identification and authentication procedures to be reviewed and updated are defined;

- + @@ -28889,7 +28889,7 @@ Identification and Authentication (Organizational Users) - + @@ -28986,7 +28986,7 @@ Multi-factor Authentication to Privileged Accounts - + @@ -29040,7 +29040,7 @@ Multi-factor Authentication to Non-privileged Accounts - + @@ -29093,7 +29093,7 @@ Local Access to Privileged Accounts - + @@ -29102,7 +29102,7 @@ Local Access to Non-privileged Accounts - + @@ -29111,7 +29111,7 @@ Individual Authentication with Group Authentication - + @@ -29189,7 +29189,7 @@

the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined;

- + @@ -29259,7 +29259,7 @@ Network Access to Non-privileged Accounts — Separate Device - + @@ -29276,7 +29276,7 @@ non-privileged accounts - + @@ -29329,7 +29329,7 @@ Network Access to Non-privileged Accounts — Replay Resistant - + @@ -29346,7 +29346,7 @@

system accounts and services for which a single sign-on capability must be provided are defined;

- + @@ -29400,7 +29400,7 @@ Remote Access — Separate Device - + @@ -29409,7 +29409,7 @@ Acceptance of PIV Credentials - + @@ -29479,7 +29479,7 @@

conditions under which out-of-band authentication is to be implemented are defined;

- + @@ -29552,7 +29552,7 @@ network - + @@ -29630,7 +29630,7 @@ network - + @@ -29685,7 +29685,7 @@ Cryptographic Bidirectional Network Authentication - + @@ -29713,7 +29713,7 @@

lease duration to be employed to standardize dynamic address allocation for devices is defined;

- + @@ -29801,7 +29801,7 @@

configuration management process to be employed to handle device identification and authentication based on attestation is defined;

- + @@ -29875,7 +29875,7 @@

a time period for preventing reuse of identifiers is defined;

- + @@ -29982,7 +29982,7 @@ Prohibit Account Identifiers as Public Identifiers - + @@ -30034,7 +30034,7 @@ Supervisor Authorization - + @@ -30043,7 +30043,7 @@ Multiple Forms of Certification - + @@ -30061,7 +30061,7 @@

characteristics used to identify individual status is defined;

- + @@ -30117,7 +30117,7 @@

a dynamic identifier policy for managing individual identifiers is defined;

- + @@ -30177,7 +30177,7 @@

external organizations with whom to coordinate the cross-organization management of identifiers are defined;

- + @@ -30226,7 +30226,7 @@ In-person Registration - + @@ -30235,7 +30235,7 @@ Pairwise Pseudonymous Identifiers - + @@ -30293,7 +30293,7 @@

protected central storage used to maintain the attributes for each uniquely identified individual, device, or service is defined;

- + @@ -30360,7 +30360,7 @@

events that trigger the change or refreshment of authenticators are defined;

- + @@ -30542,7 +30542,7 @@

authenticator composition and complexity rules are defined;

- + @@ -30666,7 +30666,7 @@ Public Key-based Authentication - + @@ -30769,7 +30769,7 @@ In-person or Trusted External Party Registration - + @@ -30778,7 +30778,7 @@ Automated Support for Password Strength Determination - + @@ -30787,7 +30787,7 @@ Change Authenticators Prior to Delivery - + @@ -30837,7 +30837,7 @@ Protection of Authenticators - + @@ -30889,7 +30889,7 @@ No Embedded Unencrypted Static Authenticators - + @@ -30949,7 +30949,7 @@

security controls implemented to manage the risk of compromise due to individuals having accounts on multiple systems are defined;

- + @@ -31006,7 +31006,7 @@

external organizations to be used for federating credentials are defined;

- + @@ -31064,7 +31064,7 @@

rules for dynamically binding identities and authenticators are defined;

- + @@ -31117,7 +31117,7 @@ Hardware Token-based Authentication - + @@ -31135,7 +31135,7 @@

biometric quality requirements for biometric-based authentication are defined;

- + @@ -31196,7 +31196,7 @@

the time period after which the use of cached authenticators is prohibited is defined;

- + @@ -31246,7 +31246,7 @@ Managing Content of PKI Trust Stores - + @@ -31299,7 +31299,7 @@ GSA-approved Products and Services - + @@ -31382,7 +31382,7 @@

the personnel or roles who authorize the issuance of authenticators are defined;

- + @@ -31434,7 +31434,7 @@ Presentation Attack Detection for Biometric Authenticators - + @@ -31502,7 +31502,7 @@

controls for protecting passwords are defined;

- + @@ -31570,7 +31570,7 @@ Authentication Feedback - + @@ -31619,7 +31619,7 @@ Cryptographic Module Authentication - + @@ -31674,7 +31674,7 @@ Identification and Authentication (Non-organizational Users) - + @@ -31747,7 +31747,7 @@ Acceptance of PIV Credentials from Other Agencies - + @@ -31812,7 +31812,7 @@ Acceptance of External Authenticators - + @@ -31893,7 +31893,7 @@ Use of FICAM-approved Products - + @@ -31910,7 +31910,7 @@

identity management profiles are defined;

- + @@ -31969,7 +31969,7 @@

a policy for using federated or PKI credentials is defined;

- + @@ -32041,7 +32041,7 @@

disassociability measures are defined;

- + @@ -32102,7 +32102,7 @@

system services and applications to be uniquely identified and authenticated are defined;

- + @@ -32158,7 +32158,7 @@ Information Exchange - + @@ -32167,7 +32167,7 @@ Transmission of Decisions - + @@ -32193,7 +32193,7 @@

circumstances or situations that require individuals accessing the system to employ supplemental authentication techniques or mechanisms are defined;

- + @@ -32256,7 +32256,7 @@

circumstances or situations requiring re-authentication are defined;

- + @@ -32314,7 +32314,7 @@ Identity Proofing - + @@ -32414,7 +32414,7 @@ Supervisor Authorization - + @@ -32462,7 +32462,7 @@ Identity Evidence - + @@ -32519,7 +32519,7 @@

methods of validation and verification of identity evidence are defined;

- + @@ -32567,7 +32567,7 @@ In-person Validation and Verification - + @@ -32623,7 +32623,7 @@ notice of proofing - + @@ -32681,7 +32681,7 @@

an identity assurance level for accepting externally proofed identities is defined;

- + @@ -32751,7 +32751,7 @@

mechanisms supporting authentication and authorization decisions are defined;

- + @@ -32824,7 +32824,7 @@ Protection of Cryptographic Keys - + @@ -32895,7 +32895,7 @@ Verification of Identity Assertions and Access Tokens - + @@ -32962,7 +32962,7 @@ Token Management - + @@ -33170,7 +33170,7 @@

events that would require the incident response procedures to be reviewed and updated are defined;

- + @@ -33394,7 +33394,7 @@

events that initiate a review of the incident response training content are defined;

- + @@ -33498,7 +33498,7 @@ Simulated Events - + @@ -33556,7 +33556,7 @@

automated mechanisms used in an incident response training environment are defined;

- + @@ -33607,7 +33607,7 @@ Breach - + @@ -33680,7 +33680,7 @@

tests used to test the effectiveness of the incident response capability for the system are defined;

- + @@ -33742,7 +33742,7 @@

automated mechanisms used to test the incident response capability are defined;

- + @@ -33796,7 +33796,7 @@ Coordination with Related Plans - + @@ -33847,7 +33847,7 @@ Continuous Improvement - + @@ -33972,7 +33972,7 @@ Incident Handling - + @@ -34150,7 +34150,7 @@

automated mechanisms used to support the incident handling process are defined;

- + @@ -34216,7 +34216,7 @@

system components that require dynamic reconfiguration are defined;

- + @@ -34287,7 +34287,7 @@

actions to be taken in response to organization-defined classes of incidents are defined;

- + @@ -34345,7 +34345,7 @@ Information Correlation - + @@ -34413,7 +34413,7 @@

security violations that automatically disable a system are defined;

- + @@ -34466,7 +34466,7 @@ Insider Threats - + @@ -34524,7 +34524,7 @@

entities that require coordination for an incident handling capability for insider threats are defined;

- + @@ -34599,7 +34599,7 @@

incident information to be correlated and shared with organization-defined external organizations are defined;

- + @@ -34659,7 +34659,7 @@

dynamic response capabilities to be employed to respond to incidents are defined;

- + @@ -34710,7 +34710,7 @@ Supply Chain Coordination - + @@ -34769,7 +34769,7 @@

the time period within which an integrated incident response team can be deployed is defined;

- + @@ -34822,7 +34822,7 @@ Malicious Code and Forensic Analysis - + @@ -34896,7 +34896,7 @@

environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined;

- + @@ -34950,7 +34950,7 @@ Security Operations Center - + @@ -35013,7 +35013,7 @@ Public Relations and Reputation Repair - + @@ -35071,7 +35071,7 @@ Incident Monitoring - + @@ -35168,7 +35168,7 @@

automated mechanisms used to analyze incident information are defined;

- + @@ -35248,7 +35248,7 @@

authorities to whom incident information is to be reported are defined;

- + @@ -35332,7 +35332,7 @@

automated mechanisms used for reporting incidents are defined;

- + @@ -35391,7 +35391,7 @@

personnel or roles to whom system vulnerabilities associated with reported incidents are reported to is/are defined;

- + @@ -35442,7 +35442,7 @@ Supply Chain Coordination - + @@ -35499,7 +35499,7 @@ Incident Response Assistance - + @@ -35574,7 +35574,7 @@

automated mechanisms used to increase the availability of incident response information and support are defined;

- + @@ -35625,7 +35625,7 @@ Coordination with External Providers - + @@ -35743,7 +35743,7 @@

organizational elements to which changes to the incident response plan are communicated are defined;

- + @@ -35962,7 +35962,7 @@ Breaches - + @@ -36067,7 +36067,7 @@

actions to be performed are defined;

- + @@ -36185,7 +36185,7 @@ Responsible Personnel - + @@ -36202,7 +36202,7 @@

frequency at which to provide information spillage response training is defined;

- + @@ -36256,7 +36256,7 @@

procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions are defined;

- + @@ -36311,7 +36311,7 @@

controls employed for personnel exposed to information not within assigned access authorizations are defined;

- + @@ -36361,7 +36361,7 @@ Integrated Information Security Analysis Team - + @@ -36441,7 +36441,7 @@

events that would require the maintenance procedures to be reviewed and updated are defined;

- + @@ -36655,7 +36655,7 @@

information to be included in organizational maintenance records is defined;

- + @@ -36796,7 +36796,7 @@ Record Content - + @@ -36832,7 +36832,7 @@

automated mechanisms used to document maintenance, repair, and replacement actions for the system are defined;

- + @@ -36936,7 +36936,7 @@

frequency at which to review previously approved system maintenance tools is defined;

- + @@ -37015,7 +37015,7 @@ Inspect Tools - + @@ -37065,7 +37065,7 @@ Inspect Media - + @@ -37122,7 +37122,7 @@

personnel or roles who can authorize removal of equipment from the facility is/are defined;

- + @@ -37211,7 +37211,7 @@ Restricted Tool Use - + @@ -37265,7 +37265,7 @@ Execution with Privilege - + @@ -37319,7 +37319,7 @@ Software Updates and Patches - + @@ -37375,7 +37375,7 @@ Nonlocal Maintenance - + @@ -37538,7 +37538,7 @@

audit events to be logged for diagnostic sessions are defined;

- + @@ -37628,7 +37628,7 @@ Document Nonlocal Maintenance - + @@ -37638,7 +37638,7 @@ Comparable Security and Sanitization - + @@ -37744,7 +37744,7 @@

authenticators that are replay resistant are defined;

- + @@ -37848,7 +37848,7 @@

personnel and roles to be notified of the date and time of planned nonlocal maintenance is/are defined;

- + @@ -37923,7 +37923,7 @@

cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined;

- + @@ -37989,7 +37989,7 @@ Disconnect Verification - + @@ -38054,7 +38054,7 @@ Maintenance Personnel - + @@ -38157,7 +38157,7 @@

alternate controls to be developed and implemented in the event that a system component cannot be sanitized, removed, or disconnected from the system are defined;

- + @@ -38248,7 +38248,7 @@ Security Clearances for Classified Systems - + @@ -38310,7 +38310,7 @@ Citizenship Requirements for Classified Systems - + @@ -38355,7 +38355,7 @@ Foreign Nationals - + @@ -38441,7 +38441,7 @@ Non-system Maintenance - + @@ -38504,7 +38504,7 @@

time period within which maintenance support and/or spare parts are to be obtained after a failure are defined;

- + @@ -38577,7 +38577,7 @@

time intervals within which preventive maintenance is to be performed on system components are defined;

- + @@ -38644,7 +38644,7 @@

time intervals within which predictive maintenance is to be performed are defined;

- + @@ -38703,7 +38703,7 @@

automated mechanisms used to transfer predictive maintenance data to a maintenance management system are defined;

- + @@ -38771,7 +38771,7 @@

trusted maintenance facilities that are not restricted or prohibited from conducting field maintenance are defined;

- + @@ -38897,7 +38897,7 @@

events that would require media protection procedures to be reviewed and updated are defined;

- + @@ -39125,7 +39125,7 @@

personnel or roles authorized to access non-digital media is/are defined;

- + @@ -39200,7 +39200,7 @@ Automated Restricted Access - + @@ -39209,7 +39209,7 @@ Cryptographic Protection - + @@ -39236,7 +39236,7 @@

controlled areas where media is exempt from marking are defined;

- + @@ -39362,7 +39362,7 @@

controlled areas within which to securely store non-digital media are defined;

- + @@ -39467,7 +39467,7 @@ Cryptographic Protection - + @@ -39503,7 +39503,7 @@

automated mechanisms to log access granted to media storage areas are defined;

- + @@ -39606,7 +39606,7 @@

controls used to control system media outside of controlled areas are defined;

- + @@ -39723,7 +39723,7 @@ Protection Outside of Controlled Areas - + @@ -39732,7 +39732,7 @@ Documentation of Activities - + @@ -39741,7 +39741,7 @@ Custodians - + @@ -39798,7 +39798,7 @@ Cryptographic Protection - + @@ -39862,7 +39862,7 @@

sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined;

- + @@ -39968,7 +39968,7 @@ Review, Approve, Track, Document, and Verify - + @@ -40069,7 +40069,7 @@

frequency with which to test sanitization procedures is defined;

- + @@ -40142,7 +40142,7 @@

circumstances requiring sanitization of portable storage devices are defined;

- + @@ -40192,7 +40192,7 @@ Controlled Unclassified Information - + @@ -40201,7 +40201,7 @@ Classified Information - + @@ -40210,7 +40210,7 @@ Media Destruction - + @@ -40227,7 +40227,7 @@

system media to be sanitized using dual authorization is defined;

- + @@ -40306,7 +40306,7 @@

conditions under which information is to be purged or wiped are defined (if selected);

- + @@ -40391,7 +40391,7 @@

controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;

- + @@ -40465,7 +40465,7 @@ Prohibit Use Without Owner - + @@ -40474,7 +40474,7 @@ Prohibit Use of Sanitization-resistant Media - + @@ -40551,7 +40551,7 @@

system media requiring downgrading is defined;

- + @@ -40654,7 +40654,7 @@ Documentation of Process - + @@ -40724,7 +40724,7 @@

the frequency with which to test downgrading procedures is defined;

- + @@ -40783,7 +40783,7 @@ Controlled Unclassified Information - + @@ -40841,7 +40841,7 @@ Classified Information - + @@ -40972,7 +40972,7 @@

events that would require the physical and environmental protection procedures to be reviewed and updated are defined;

- + @@ -41170,7 +41170,7 @@

frequency at which to review the access list detailing authorized facility access by individuals is defined;

- + @@ -41285,7 +41285,7 @@ Access by Position or Role - + @@ -41346,7 +41346,7 @@

a list of acceptable forms of identification for visitor access to the facility where the system resides is defined;

- + @@ -41418,7 +41418,7 @@

physical access authorizations for unescorted access to the facility where the system resides are defined (if selected);

- + @@ -41559,7 +41559,7 @@

frequency at which to change keys is defined;

- + @@ -41758,7 +41758,7 @@

physical spaces containing one or more components of the system are defined;

- + @@ -41827,7 +41827,7 @@

the frequency at which to perform security checks at the physical perimeter of the facility or system for exfiltration of information or removal of system components is defined;

- + @@ -41890,7 +41890,7 @@

physical access points to the facility where the system resides are defined;

- + @@ -41952,7 +41952,7 @@

system components to be protected from unauthorized physical access are defined;

- + @@ -42023,7 +42023,7 @@

hardware components to be protected from physical tampering or alteration are defined;

- + @@ -42073,7 +42073,7 @@ Facility Penetration Testing - + @@ -42082,7 +42082,7 @@ Physical Barriers - + @@ -42130,7 +42130,7 @@

locations within the facility where access control vestibules are to be employed are defined;

- + @@ -42193,7 +42193,7 @@

security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility are defined;

- + @@ -42259,7 +42259,7 @@

output devices that require physical access control to output are defined;

- + @@ -42312,7 +42312,7 @@ Access to Output by Authorized Individuals - + @@ -42321,7 +42321,7 @@ Link to Individual Identity - + @@ -42377,7 +42377,7 @@ Marking Output Devices - + @@ -42404,7 +42404,7 @@

events or potential indication of events requiring physical access logs to be reviewed are defined;

- + @@ -42505,7 +42505,7 @@ Intrusion Alarms and Surveillance Equipment - + @@ -42593,7 +42593,7 @@

automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined;

- + @@ -42680,7 +42680,7 @@

time period for which to retain video recordings is defined;

- + @@ -42768,7 +42768,7 @@

physical spaces containing one or more components of the system are defined;

- + @@ -42824,7 +42824,7 @@ Visitor Control - + @@ -42858,7 +42858,7 @@

personnel to whom visitor access records anomalies are reported to is/are defined;

- + @@ -42955,7 +42955,7 @@

automated mechanisms used to review visitor access records are defined;

- + @@ -43013,7 +43013,7 @@ Physical Access Records - + @@ -43030,7 +43030,7 @@

elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs are defined;

- + @@ -43083,7 +43083,7 @@ Power Equipment and Cabling - + @@ -43145,7 +43145,7 @@

distance by which redundant power cabling paths are to be physically separated is defined;

- + @@ -43199,7 +43199,7 @@

the critical system components that require automatic voltage controls are defined;

- + @@ -43265,7 +43265,7 @@

location of emergency shutoff switches or devices by system or system component is defined;

- + @@ -43337,7 +43337,7 @@ Accidental and Unauthorized Activation - + @@ -43355,7 +43355,7 @@ transition of the system to long-term alternate power - + @@ -43413,7 +43413,7 @@ automatically - + @@ -43487,7 +43487,7 @@ full operational capability - + @@ -43564,7 +43564,7 @@ Emergency Lighting - + @@ -43631,7 +43631,7 @@ Essential Mission and Business Functions - + @@ -43681,7 +43681,7 @@ Fire Protection - + @@ -43773,7 +43773,7 @@

emergency responders to be notified in the event of a fire are defined;

- + @@ -43856,7 +43856,7 @@

emergency responders to be notified in the event of a fire are defined;

- + @@ -43938,7 +43938,7 @@ Automatic Fire Suppression - + @@ -43963,7 +43963,7 @@

a time period for resolving deficiencies identified by fire protection inspections is defined;

- + @@ -44051,7 +44051,7 @@

frequency at which to monitor environmental control levels is defined;

- + @@ -44124,7 +44124,7 @@

automatic environmental controls to prevent fluctuations that are potentially harmful to the system are defined;

- + @@ -44181,7 +44181,7 @@

personnel or roles to be notified by environmental control monitoring when environmental changes are potentially harmful to personnel or equipment is/are defined;

- + @@ -44239,7 +44239,7 @@ Water Damage Protection - + @@ -44324,7 +44324,7 @@

automated mechanisms used to detect the presence of water near the system are defined;

- + @@ -44402,7 +44402,7 @@

types of system components to be authorized and controlled when exiting the facility are defined;

- + @@ -44510,7 +44510,7 @@

controls to be employed at alternate work sites are defined;

- + @@ -44608,7 +44608,7 @@

physical and environmental hazards that could result in potential damage to system components within the facility are defined;

- + @@ -44659,7 +44659,7 @@ Facility Site - + @@ -44669,7 +44669,7 @@ Information Leakage - + @@ -44719,7 +44719,7 @@ National Emissions Policies and Procedures - + @@ -44804,7 +44804,7 @@

controlled areas within which asset location and movement are to be tracked and monitored are defined;

- + @@ -44875,7 +44875,7 @@

system and system components requiring protection against electromagnetic pulse damage are defined;

- + @@ -44932,7 +44932,7 @@

system hardware components to be marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component are defined;

- + @@ -44987,7 +44987,7 @@ Facility Location - + @@ -45128,7 +45128,7 @@

events that would require procedures to be reviewed and updated are defined;

- + @@ -45342,7 +45342,7 @@

frequency to review system security and privacy plans is defined;

- + @@ -45785,7 +45785,7 @@ Concept of Operations - + @@ -45794,7 +45794,7 @@ Functional Architecture - + @@ -45803,7 +45803,7 @@ Plan and Coordinate with Other Organizational Entities - + @@ -45813,7 +45813,7 @@ System Security Plan Update - + @@ -45846,7 +45846,7 @@

frequency for individuals to read and re-acknowledge the rules of behavior is defined (if selected);

- + @@ -45959,7 +45959,7 @@ Social Media and External Site/Application Usage Restrictions - + @@ -46038,7 +46038,7 @@ Privacy Impact Assessment - + @@ -46047,7 +46047,7 @@ Security-related Activity Planning - + @@ -46064,7 +46064,7 @@

frequency for review and update of the Concept of Operations (CONOPS) is defined;

- + @@ -46141,7 +46141,7 @@

frequency for review and update to reflect changes in the enterprise architecture;

- + @@ -46335,7 +46335,7 @@

locations and architectural layers are defined;

- + @@ -46442,7 +46442,7 @@

locations and architectural layers are defined;

- + @@ -46506,7 +46506,7 @@

security and privacy controls and related processes to be centrally managed are defined;

- + @@ -46560,7 +46560,7 @@ Baseline Selection - + @@ -46628,7 +46628,7 @@ Baseline Tailoring - + @@ -46719,7 +46719,7 @@

events that trigger the review and update of the organization-wide information security program plan are defined;

- + @@ -46907,7 +46907,7 @@ Information Security Program Leadership Role - + @@ -46974,7 +46974,7 @@ Information Security and Privacy Resources - + @@ -47081,7 +47081,7 @@ Plan of Action and Milestones Process - + @@ -47254,7 +47254,7 @@

the frequency at which to update the inventory of organizational systems is defined;

- + @@ -47319,7 +47319,7 @@

the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined;

- + @@ -47396,7 +47396,7 @@ Measures of Performance - + @@ -47482,7 +47482,7 @@ Enterprise Architecture - + @@ -47580,7 +47580,7 @@

non-essential functions or services to be offloaded are defined;

- + @@ -47634,7 +47634,7 @@ Critical Infrastructure Plan - + @@ -47733,7 +47733,7 @@

the frequency at which to review and update the risk management strategy is defined;

- + @@ -47868,7 +47868,7 @@ Authorization Process - + @@ -47969,7 +47969,7 @@

the frequency at which to review and revise the mission and business processes is defined;

- + @@ -48081,7 +48081,7 @@ Insider Threat Program - + @@ -48146,7 +48146,7 @@ Security and Privacy Workforce - + @@ -48207,7 +48207,7 @@ Testing, Training, and Monitoring - + @@ -48361,7 +48361,7 @@ Security and Privacy Groups and Associations - + @@ -48466,7 +48466,7 @@ Threat Awareness Program - + @@ -48521,7 +48521,7 @@ Automated Means for Sharing Threat Intelligence - + @@ -48596,7 +48596,7 @@

the frequency at which to review and update the procedures is defined;

- + @@ -48681,7 +48681,7 @@

the frequency of updates to the privacy program plan is defined;

- + @@ -48872,7 +48872,7 @@ Privacy Program Leadership Role - + @@ -48947,7 +48947,7 @@ Dissemination of Privacy Program Information - + @@ -49058,7 +49058,7 @@ Privacy Policies on Websites, Applications, and Digital Services - + @@ -49173,7 +49173,7 @@ Accounting of Disclosures - + @@ -49293,7 +49293,7 @@ Personally Identifiable Information Quality Management - + @@ -49473,7 +49473,7 @@

the responsibilities of a Data Governance Body are defined;

- + @@ -49523,7 +49523,7 @@ Data Integrity Board - + @@ -49624,7 +49624,7 @@

the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research is defined;

- + @@ -49854,7 +49854,7 @@

the time period for responding to complaints is defined;

- + @@ -50010,7 +50010,7 @@

the frequency for reviewing and updating privacy reports is defined;

- + @@ -50115,7 +50115,7 @@

the frequency for reviewing and updating risk framing considerations is defined;

- + @@ -50270,7 +50270,7 @@ Risk Management Program Leadership Roles - + @@ -50364,7 +50364,7 @@

the frequency for reviewing and updating the supply chain risk management strategy is defined;

- + @@ -50515,7 +50515,7 @@ Suppliers of Critical or Mission-essential Items - + @@ -50649,7 +50649,7 @@

the frequency at which to report the privacy status of organizational systems is defined;

- + @@ -50859,7 +50859,7 @@

the systems or system components supporting mission-essential services or functions are defined;

- + @@ -50975,7 +50975,7 @@

events that would require the personnel security procedures to be reviewed and updated are defined;

- + @@ -51174,7 +51174,7 @@

the frequency at which to review and update position risk designations is defined;

- + @@ -51278,7 +51278,7 @@

the frequency of rescreening individuals where it is so indicated is defined;

- + @@ -51365,7 +51365,7 @@ Classified Information - + @@ -51422,7 +51422,7 @@ Formal Indoctrination - + @@ -51479,7 +51479,7 @@

additional personnel screening criteria to be satisfied for individuals accessing a system processing, storing, or transmitting information requiring special protection are defined;

- + @@ -51561,7 +51561,7 @@

citizenship requirements to be met by individuals to access a system processing, storing, or transmitting information are defined;

- + @@ -51627,7 +51627,7 @@

information security topics to be discussed when conducting exit interviews are defined;

- + @@ -51728,7 +51728,7 @@ Post-employment Requirements - + @@ -51815,7 +51815,7 @@

personnel or roles to be notified upon termination of an individual is/are defined (if selected);

- + @@ -51898,7 +51898,7 @@

time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined;

- + @@ -52004,7 +52004,7 @@

the frequency at which to re-sign access agreements to maintain access to organizational information is defined;

- + @@ -52108,7 +52108,7 @@ Information Requiring Special Protection - + @@ -52117,7 +52117,7 @@ Classified Information Requiring Special Protection - + @@ -52194,7 +52194,7 @@ Post-employment Requirements - + @@ -52279,7 +52279,7 @@

time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined;

- + @@ -52405,7 +52405,7 @@

the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated is defined;

- + @@ -52477,7 +52477,7 @@ Position Descriptions - + @@ -52607,7 +52607,7 @@

events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated are defined;

- + @@ -52813,7 +52813,7 @@

the type of processing of personally identifiable information to be restricted is defined;

- + @@ -52909,7 +52909,7 @@

elements of personally identifiable information to be tagged are defined;

- + @@ -52979,7 +52979,7 @@

automated mechanisms used to manage enforcement of the authorized processing of personally identifiable information are defined;

- + @@ -53068,7 +53068,7 @@

requirements for changing the processing of personally identifiable information are defined;

- + @@ -53207,7 +53207,7 @@

elements of personally identifiable information to be tagged are defined;

- + @@ -53274,7 +53274,7 @@

automated mechanisms for tracking the processing purposes of personally identifiable information are defined;

- + @@ -53339,7 +53339,7 @@

the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined;

- + @@ -53401,7 +53401,7 @@

tailoring mechanisms for processing selected elements of personally identifiable information permissions are defined;

- + @@ -53476,7 +53476,7 @@

personally identifiable information processing to be presented in conjunction with organization-defined consent mechanisms is defined;

- + @@ -53533,7 +53533,7 @@

the tools or mechanisms to be implemented for revoking consent to the processing of personally identifiable information are defined;

- + @@ -53599,7 +53599,7 @@

information to be included with the notice about the processing of personally identifiable information is defined;

- + @@ -53718,7 +53718,7 @@

the frequency at which to present a notice of personally identifiable information processing is defined;

- + @@ -53765,7 +53765,7 @@ Privacy Act Statements - + @@ -53815,7 +53815,7 @@ System of Records Notice - + @@ -53910,7 +53910,7 @@

the frequency at which to review all routine uses published in the system of records notice is defined;

- + @@ -53964,7 +53964,7 @@

the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined;

- + @@ -54034,7 +54034,7 @@

processing conditions to be applied for specific categories of personally identifiable information are defined;

- + @@ -54091,7 +54091,7 @@ Social Security Numbers - + @@ -54190,7 +54190,7 @@ First Amendment Information - + @@ -54237,7 +54237,7 @@ Computer Matching Requirements - + @@ -54427,7 +54427,7 @@

events that would require risk assessment procedures to be reviewed and updated are defined;

- + @@ -54616,7 +54616,7 @@ Security Categorization - + @@ -54713,7 +54713,7 @@ Impact-level Prioritization - + @@ -54803,7 +54803,7 @@

the frequency to update the risk assessment is defined;

- + @@ -54984,7 +54984,7 @@

the frequency at which to update the supply chain risk assessment is defined;

- + @@ -55062,7 +55062,7 @@ Use of All-source Intelligence - + @@ -55123,7 +55123,7 @@

means to determine the current cyber threat environment on an ongoing basis;

- + @@ -55204,7 +55204,7 @@

advanced analytics capabilities to predict and identify risks are defined;

- + @@ -55267,7 +55267,7 @@ Risk Assessment Update - + @@ -55311,7 +55311,7 @@

personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared;

- + @@ -55481,7 +55481,7 @@ Update Tool Capability - + @@ -55507,7 +55507,7 @@

the frequency for updating the system vulnerabilities to be scanned is defined (if selected);

- + @@ -55560,7 +55560,7 @@ Breadth and Depth of Coverage - + @@ -55619,7 +55619,7 @@

corrective actions to be taken if information about the system is discoverable are defined;

- + @@ -55706,7 +55706,7 @@

vulnerability scanning activities selected for privileged access authorization to system components are defined;

- + @@ -55773,7 +55773,7 @@

automated mechanisms to compare the results of multiple vulnerability scans are defined;

- + @@ -55825,7 +55825,7 @@ Automated Detection and Notification of Unauthorized Components - + @@ -55850,7 +55850,7 @@

a time period for a potential previous exploit of a system is defined;

- + @@ -55908,7 +55908,7 @@ Penetration Testing and Analyses - + @@ -55917,7 +55917,7 @@ Correlate Scanning Information - + @@ -55972,7 +55972,7 @@ Public Disclosure Program - + @@ -56060,7 +56060,7 @@

events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are defined (if selected);

- + @@ -56108,7 +56108,7 @@ Risk Response - + @@ -56189,7 +56189,7 @@ Privacy Impact Assessments - + @@ -56306,7 +56306,7 @@

decision points in the system development life cycle when a criticality analysis is to be performed are defined;

- + @@ -56378,7 +56378,7 @@

the frequency at which to employ the threat hunting capability is defined;

- + @@ -56540,7 +56540,7 @@

events that would require the system and services acquisition procedures to be reviewed and updated are defined;

- + @@ -56736,7 +56736,7 @@ Allocation of Resources - + @@ -56860,7 +56860,7 @@

system development life cycle is defined;

- + @@ -57008,7 +57008,7 @@ Manage Preproduction Environment - + @@ -57067,7 +57067,7 @@ Use of Live or Operational Data - + @@ -57156,7 +57156,7 @@ Technology Refresh - + @@ -57239,7 +57239,7 @@

contract language is defined (if selected);

- + @@ -57469,7 +57469,7 @@ Functional Properties of Controls - + @@ -57550,7 +57550,7 @@

level of detail is defined;

- + @@ -57667,7 +57667,7 @@

quality control processes are defined (if selected);

- + @@ -57750,7 +57750,7 @@ Assignment of Components to Systems - + @@ -57767,7 +57767,7 @@

security configurations for the system, component, or service are defined;

- + @@ -57837,7 +57837,7 @@ Use of Information Assurance Products - + @@ -57912,7 +57912,7 @@ NIAP-approved Protection Profiles - + @@ -57986,7 +57986,7 @@ Continuous Monitoring Plan for Controls - + @@ -58043,7 +58043,7 @@ Functions, Ports, Protocols, and Services in Use - + @@ -58114,7 +58114,7 @@ Use of Approved PIV Products - + @@ -58179,7 +58179,7 @@

Privacy Act requirements for the operation of a system of records are defined;

- + @@ -58245,7 +58245,7 @@

time frame to remove data from a contractor system and return it to the organization is defined;

- + @@ -58339,7 +58339,7 @@

personnel or roles to distribute system documentation to is/are defined;

- + @@ -58589,7 +58589,7 @@ Functional Properties of Security Controls - + @@ -58598,7 +58598,7 @@ Security-relevant External System Interfaces - + @@ -58607,7 +58607,7 @@ High-level Design - + @@ -58616,7 +58616,7 @@ Low-level Design - + @@ -58625,7 +58625,7 @@ Source Code - + @@ -58635,7 +58635,7 @@ Software Usage Restrictions - + @@ -58645,7 +58645,7 @@ User-installed Software - + @@ -58674,7 +58674,7 @@

privacy engineering principles are defined;

- + @@ -58807,7 +58807,7 @@ Clear Abstractions - + @@ -58868,7 +58868,7 @@

systems or system components that implement the security design principle of least common mechanism are defined;

- + @@ -58940,7 +58940,7 @@

systems or system components that implement the security design principle of layering are defined;

- + @@ -59013,7 +59013,7 @@

systems or system components that implement the security design principle of partially ordered dependencies are defined;

- + @@ -59074,7 +59074,7 @@

systems or system components that implement the security design principle of efficiently mediated access are defined;

- + @@ -59137,7 +59137,7 @@

systems or system components that implement the security design principle of minimized sharing are defined;

- + @@ -59199,7 +59199,7 @@

systems or system components that implement the security design principle of reduced complexity are defined;

- + @@ -59260,7 +59260,7 @@

systems or system components that implement the security design principle of secure evolvability are defined;

- + @@ -59322,7 +59322,7 @@

systems or system components that implement the security design principle of trusted components are defined;

- + @@ -59387,7 +59387,7 @@

systems or system components that implement the security design principle of hierarchical trust are defined;

- + @@ -59448,7 +59448,7 @@

systems or system components that implement the security design principle of inverse modification threshold are defined;

- + @@ -59509,7 +59509,7 @@

systems or system components that implement the security design principle of hierarchical protection are defined;

- + @@ -59570,7 +59570,7 @@

systems or system components that implement the security design principle of minimized security elements are defined;

- + @@ -59631,7 +59631,7 @@

systems or system components that implement the security design principle of least privilege are defined;

- + @@ -59695,7 +59695,7 @@

systems or system components that implement the security design principle of predicate permission are defined;

- + @@ -59757,7 +59757,7 @@

systems or system components that implement the security design principle of self-reliant trustworthiness are defined;

- + @@ -59818,7 +59818,7 @@

systems or system components that implement the security design principle of secure distributed composition are defined;

- + @@ -59879,7 +59879,7 @@

systems or system components that implement the security design principle of trusted communications channels are defined;

- + @@ -59943,7 +59943,7 @@

systems or system components that implement the security design principle of continuous protection are defined;

- + @@ -60015,7 +60015,7 @@

systems or system components that implement the security design principle of secure metadata management are defined;

- + @@ -60077,7 +60077,7 @@

systems or system components that implement the security design principle of self-analysis are defined;

- + @@ -60150,7 +60150,7 @@

systems or system components that implement the security design principle of traceability are defined;

- + @@ -60241,7 +60241,7 @@

systems or system components that implement the security design principle of secure defaults are defined;

- + @@ -60327,7 +60327,7 @@

systems or system components that implement the security design principle of secure recovery are defined;

- + @@ -60422,7 +60422,7 @@

systems or system components that implement the security design principle of economic security are defined;

- + @@ -60485,7 +60485,7 @@

systems or system components that implement the security design principle of performance security are defined;

- + @@ -60552,7 +60552,7 @@

systems or system components that implement the security design principle of human factored security are defined;

- + @@ -60616,7 +60616,7 @@

systems or system components that implement the security design principle of acceptable security are defined;

- + @@ -60683,7 +60683,7 @@

systems or system components that implement the security design principle of repeatable and documented procedures are defined;

- + @@ -60753,7 +60753,7 @@

systems or system components that implement the security design principle of procedural rigor are defined;

- + @@ -60817,7 +60817,7 @@

systems or system components that implement the security design principle of secure system modification are defined;

- + @@ -60886,7 +60886,7 @@

systems or system components that implement the security design principle of sufficient documentation are defined;

- + @@ -60956,7 +60956,7 @@

processes that implement the privacy principle of minimization are defined;

- + @@ -61039,7 +61039,7 @@

processes, methods, and techniques employed to monitor control compliance by external service providers are defined;

- + @@ -61169,7 +61169,7 @@

personnel or roles that approve the acquisition or outsourcing of dedicated information security services is/are defined;

- + @@ -61254,7 +61254,7 @@

external system services that require the identification of functions, ports, protocols, and other services are defined;

- + @@ -61323,7 +61323,7 @@

privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined;

- + @@ -61410,7 +61410,7 @@

actions to be taken to verify that the interests of external service providers are consistent with and reflect organizational interests are defined;

- + @@ -61493,7 +61493,7 @@

requirements or conditions for restricting the location of are defined;

- + @@ -61553,7 +61553,7 @@ Organization-controlled Cryptographic Keys - + @@ -61613,7 +61613,7 @@ Organization-controlled Integrity Checking - + @@ -61672,7 +61672,7 @@ Processing and Storage Location — U.S. Jurisdiction - + @@ -61760,7 +61760,7 @@

personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined;

- + @@ -61922,7 +61922,7 @@ Software and Firmware Integrity Verification - + @@ -61984,7 +61984,7 @@ Alternative Configuration Management Processes - + @@ -62045,7 +62045,7 @@ Hardware Integrity Verification - + @@ -62103,7 +62103,7 @@ Trusted Generation - + @@ -62164,7 +62164,7 @@ Mapping Integrity for Version Control - + @@ -62222,7 +62222,7 @@ Trusted Distribution - + @@ -62316,7 +62316,7 @@

configuration change management and control processes in which privacy representatives are required to be included are defined;

- + @@ -62403,7 +62403,7 @@

depth and coverage of testing/evaluation is defined;

- + @@ -62555,7 +62555,7 @@ Static Code Analysis - + @@ -62684,7 +62684,7 @@

acceptance criteria to be met by produced evidence for vulnerability analyses are defined;

- + @@ -62856,7 +62856,7 @@

independence criteria to be satisfied by an independent agent are defined;

- + @@ -62959,7 +62959,7 @@

processes, procedures, and/or techniques used for manual code reviews are defined;

- + @@ -63045,7 +63045,7 @@

constraints of penetration testing are defined;

- + @@ -63137,7 +63137,7 @@ Attack Surface Reviews - + @@ -63214,7 +63214,7 @@

the depth of testing and evaluation of required controls is defined;

- + @@ -63280,7 +63280,7 @@ Dynamic Code Analysis - + @@ -63347,7 +63347,7 @@ Interactive Application Security Testing - + @@ -63415,7 +63415,7 @@ Supply Chain Protection - + @@ -63423,7 +63423,7 @@ Acquisition Strategies / Tools / Methods - + @@ -63432,7 +63432,7 @@ Supplier Reviews - + @@ -63441,7 +63441,7 @@ Trusted Shipping and Warehousing - + @@ -63450,7 +63450,7 @@ Diversity of Suppliers - + @@ -63459,7 +63459,7 @@ Limitation of Harm - + @@ -63468,7 +63468,7 @@ Minimizing Procurement Time - + @@ -63477,7 +63477,7 @@ Assessments Prior to Selection / Acceptance / Update - + @@ -63486,7 +63486,7 @@ Use of All-source Intelligence - + @@ -63495,7 +63495,7 @@ Operations Security - + @@ -63504,7 +63504,7 @@ Validate as Genuine and Not Altered - + @@ -63513,7 +63513,7 @@ Penetration Testing / Analysis of Elements, Processes, and Actors - + @@ -63522,7 +63522,7 @@ Inter-organizational Agreements - + @@ -63531,7 +63531,7 @@ Critical Information System Components - + @@ -63541,7 +63541,7 @@ Identity and Traceability - + @@ -63551,7 +63551,7 @@ Processes to Address Weaknesses or Deficiencies - + @@ -63561,7 +63561,7 @@ Trustworthiness - + @@ -63570,7 +63570,7 @@ Criticality Analysis - + @@ -63578,7 +63578,7 @@ Critical Components with No Viable Alternative Sourcing - + @@ -63615,7 +63615,7 @@

privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined;

- + @@ -63796,7 +63796,7 @@

program review milestones are defined (if selected);

- + @@ -63860,7 +63860,7 @@ Security and Privacy Tracking Tools - + @@ -63950,7 +63950,7 @@

the depth of criticality analysis is defined;

- + @@ -64036,7 +64036,7 @@ Threat Modeling and Vulnerability Analysis - + @@ -64053,7 +64053,7 @@

thresholds to which attack surfaces are to be reduced are defined;

- + @@ -64114,7 +64114,7 @@ Continuous Improvement - + @@ -64190,7 +64190,7 @@

personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are defined;

- + @@ -64285,7 +64285,7 @@ Reuse of Threat and Vulnerability Information - + @@ -64341,7 +64341,7 @@ Use of Live Data - + @@ -64350,7 +64350,7 @@ Incident Response Plan - + @@ -64416,7 +64416,7 @@ Archive System or Component - + @@ -64464,7 +64464,7 @@ Minimize Personally Identifiable Information - + @@ -64533,7 +64533,7 @@

training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms provided by the developer of the system, system component, or system service is defined;

- + @@ -64589,7 +64589,7 @@ Developer Security and Privacy Architecture and Design - + @@ -64719,7 +64719,7 @@

organizational privacy policy to be enforced is defined;

- + @@ -64807,7 +64807,7 @@ Security-relevant Components - + @@ -64888,7 +64888,7 @@ Formal Correspondence - + @@ -65010,7 +65010,7 @@ informal demonstration, convincing argument with formal methods as feasible - + @@ -65125,7 +65125,7 @@ Conceptually Simple Design - + @@ -65195,7 +65195,7 @@ Structure for Testing - + @@ -65249,7 +65249,7 @@ Structure for Least Privilege - + @@ -65321,7 +65321,7 @@

capabilities to be implemented by systems or components are defined;

- + @@ -65382,7 +65382,7 @@

critical systems or system components to be designed differently are defined;

- + @@ -65433,7 +65433,7 @@ Tamper Resistance and Detection - + @@ -65441,7 +65441,7 @@ Multiple Phases of System Development Life Cycle - + @@ -65450,7 +65450,7 @@ Inspection of Systems or Components - + @@ -65459,7 +65459,7 @@ Component Authenticity - + @@ -65467,7 +65467,7 @@ Anti-counterfeit Training - + @@ -65476,7 +65476,7 @@ Configuration Control for Component Service and Repair - + @@ -65485,7 +65485,7 @@ Component Disposal - + @@ -65494,7 +65494,7 @@ Anti-counterfeit Scanning - + @@ -65513,7 +65513,7 @@

critical system components to be reimplemented or custom-developed are defined;

- + @@ -65595,7 +65595,7 @@

additional personnel screening criteria for the developer are defined;

- + @@ -65673,7 +65673,7 @@ Validation of Screening - + @@ -65699,7 +65699,7 @@

support from external providers is defined (if selected);

- + @@ -65768,7 +65768,7 @@ Alternative Sources for Continued Support - + @@ -65795,7 +65795,7 @@

systems or system components supporting mission-essential services or functions are defined;

- + @@ -65920,7 +65920,7 @@

events that would require the system and communications protection procedures to be reviewed and updated are defined;

- + @@ -66111,7 +66111,7 @@ Separation of System and User Functionality - + @@ -66167,7 +66167,7 @@ Interfaces for Non-privileged Users - + @@ -66219,7 +66219,7 @@ Disassociability - + @@ -66271,7 +66271,7 @@ Security Function Isolation - + @@ -66335,7 +66335,7 @@ Hardware Separation - + @@ -66386,7 +66386,7 @@ Access and Flow Control Functions - + @@ -66455,7 +66455,7 @@ Minimize Nonsecurity Functionality - + @@ -66505,7 +66505,7 @@ Module Coupling and Cohesiveness - + @@ -66565,7 +66565,7 @@ Layered Structures - + @@ -66617,7 +66617,7 @@ Information in Shared System Resources - + @@ -66676,7 +66676,7 @@ Security Levels - + @@ -66693,7 +66693,7 @@

procedures to prevent unauthorized information transfer via shared resources are defined;

- + @@ -66767,7 +66767,7 @@

controls to achieve the denial-of-service objective by type of denial-of-service event are defined;

- + @@ -66847,7 +66847,7 @@

denial-of-service attacks for which to restrict the ability of individuals to launch are defined;

- + @@ -66898,7 +66898,7 @@ Capacity, Bandwidth, and Redundancy - + @@ -66964,7 +66964,7 @@

system resources to be monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks are defined;

- + @@ -67058,7 +67058,7 @@

controls to protect the availability of resources are defined (if selected);

- + @@ -67119,7 +67119,7 @@ logically - + @@ -67245,7 +67245,7 @@ Physically Separated Subnetworks - + @@ -67254,7 +67254,7 @@ Public Access - + @@ -67263,7 +67263,7 @@ Access Points - + @@ -67324,7 +67324,7 @@

the frequency at which to review exceptions to traffic flow policy is defined;

- + @@ -67491,7 +67491,7 @@

systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected).

- + @@ -67550,7 +67550,7 @@ Response to Recognized Failures - + @@ -67567,7 +67567,7 @@

safeguards to securely provision split tunneling are defined;

- + @@ -67636,7 +67636,7 @@

external networks to which internal communications traffic is to be routed are defined;

- + @@ -67689,7 +67689,7 @@ Restrict Threatening Outgoing Communications Traffic - + @@ -67783,7 +67783,7 @@

the frequency for conducting exfiltration tests is defined;

- + @@ -67867,7 +67867,7 @@

authorized destinations to which incoming communications from authorized sources may be routed are defined;

- + @@ -67934,7 +67934,7 @@

system components where host-based boundary protection mechanisms are to be implemented are defined;

- + @@ -67993,7 +67993,7 @@

information security tools, mechanisms, and support components to be isolated from other internal system components are defined;

- + @@ -68055,7 +68055,7 @@

managed interfaces to be protected against unauthorized physical connections are defined;

- + @@ -68107,7 +68107,7 @@ Networked Privileged Accesses - + @@ -68172,7 +68172,7 @@ Prevent Discovery of System Components - + @@ -68224,7 +68224,7 @@ Automated Enforcement of Protocol Formats - + @@ -68276,7 +68276,7 @@ Fail Secure - + @@ -68339,7 +68339,7 @@

communication clients that are independently configured by end users and external service providers are defined;

- + @@ -68408,7 +68408,7 @@

system components to be dynamically isolated from other system components are defined;

- + @@ -68477,7 +68477,7 @@

missions and/or business functions to be supported by system components isolated by boundary protection mechanisms are defined;

- + @@ -68532,7 +68532,7 @@ Separate Subnets for Connecting to Different Security Domains - + @@ -68585,7 +68585,7 @@ Disable Sender Feedback on Protocol Validation Failure - + @@ -68645,7 +68645,7 @@

processing rules for systems that process personally identifiable information are defined;

- + @@ -68773,7 +68773,7 @@

the boundary protection device required for a direct connection to an external network is defined;

- + @@ -68833,7 +68833,7 @@

the boundary protection device required for a direct connection to an external network is defined;

- + @@ -68902,7 +68902,7 @@

the boundary protection device required for a direct connection of unclassified, non-national security system to an external network is defined;

- + @@ -68962,7 +68962,7 @@

the system that is prohibited from directly connecting to a public network is defined;

- + @@ -69030,7 +69030,7 @@

critical system components and functions to be isolated are defined;

- + @@ -69092,7 +69092,7 @@ integrity - + @@ -69171,7 +69171,7 @@ detect changes to information - + @@ -69232,7 +69232,7 @@ integrity - + @@ -69298,7 +69298,7 @@

alternative physical controls to protect message externals are defined;

- + @@ -69359,7 +69359,7 @@

alternative physical controls to protect against unauthorized disclosure of communication patterns are defined;

- + @@ -69428,7 +69428,7 @@ detect changes to information - + @@ -69479,7 +69479,7 @@ Transmission Confidentiality - + @@ -69496,7 +69496,7 @@

a time period of inactivity after which the system terminates a network connection associated with a communication session is defined;

- + @@ -69563,7 +69563,7 @@

security functions of the system are defined;

- + @@ -69642,7 +69642,7 @@

security functions of the system are defined;

- + @@ -69720,7 +69720,7 @@

requirements for key generation, distribution, storage, access, and destruction are defined;

- + @@ -69807,7 +69807,7 @@ Availability - + @@ -69865,7 +69865,7 @@ NSA-approved - + @@ -69943,7 +69943,7 @@ certificates issued in accordance with organization-defined requirements - + @@ -70011,7 +70011,7 @@ PKI Certificates - + @@ -70020,7 +70020,7 @@ PKI Certificates / Hardware Tokens - + @@ -70029,7 +70029,7 @@ Physical Control of Keys - + @@ -70097,7 +70097,7 @@

types of cryptography for each specified cryptographic use are defined;

- + @@ -70193,7 +70193,7 @@ FIPS-validated Cryptography - + @@ -70202,7 +70202,7 @@ NSA-approved Cryptography - + @@ -70211,7 +70211,7 @@ Individuals Without Formal Access Approvals - + @@ -70220,7 +70220,7 @@ Digital Signatures - + @@ -70230,7 +70230,7 @@ Public Access Protections - + @@ -70255,7 +70255,7 @@

exceptions where remote activation is to be allowed are defined;

- + @@ -70331,7 +70331,7 @@ logical - + @@ -70382,7 +70382,7 @@ Blocking Inbound and Outbound Communications Traffic - + @@ -70407,7 +70407,7 @@

secure work areas where collaborative computing devices are to be disabled or removed from systems or system components are defined;

- + @@ -70467,7 +70467,7 @@

online meetings and teleconferences for which an explicit indication of current participants is to be provided are defined;

- + @@ -70538,7 +70538,7 @@

privacy attributes to be associated with information exchanged are defined;

- + @@ -70610,7 +70610,7 @@ Integrity Verification - + @@ -70671,7 +70671,7 @@ Anti-spoofing Mechanisms - + @@ -70731,7 +70731,7 @@

mechanisms or techniques to bind security and privacy attributes to transmitted information are defined;

- + @@ -70792,7 +70792,7 @@

a certificate policy for issuing public key certificates is defined;

- + @@ -70865,7 +70865,7 @@ Mobile Code - + @@ -70988,7 +70988,7 @@

corrective actions to be taken when unacceptable mobile code is identified are defined;

- + @@ -71060,7 +71060,7 @@

mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined;

- + @@ -71135,7 +71135,7 @@

unacceptable mobile code to be prevented from downloading and executing is defined;

- + @@ -71212,7 +71212,7 @@

actions to be enforced by the system prior to executing mobile code are defined;

- + @@ -71275,7 +71275,7 @@ Allow Execution Only in Confined Environments - + @@ -71331,7 +71331,7 @@ Voice Over Internet Protocol - + @@ -71342,7 +71342,7 @@ Secure Name/Address Resolution Service (Authoritative Source) - + @@ -71431,7 +71431,7 @@ Child Subspaces - + @@ -71440,7 +71440,7 @@ Data Origin and Integrity - + @@ -71499,7 +71499,7 @@ Secure Name/Address Resolution Service (Recursive or Caching Resolver) - + @@ -71568,7 +71568,7 @@ Data Origin and Integrity - + @@ -71578,7 +71578,7 @@ Architecture and Provisioning for Name/Address Resolution Service - + @@ -71647,7 +71647,7 @@ Session Authenticity - + @@ -71701,7 +71701,7 @@ Invalidate Session Identifiers at Logout - + @@ -71749,7 +71749,7 @@ User-initiated Logouts and Message Displays - + @@ -71766,7 +71766,7 @@

randomness requirements for generating a unique session identifier for each session are defined;

- + @@ -71827,7 +71827,7 @@ Unique Session Identifiers with Randomization - + @@ -71845,7 +71845,7 @@

certificate authorities to be allowed for verification of the establishment of protected sessions are defined;

- + @@ -71922,7 +71922,7 @@

system state information to be preserved in the event of a system failure is defined;

- + @@ -71990,7 +71990,7 @@

system components to be employed with minimal functionality and information storage are defined;

- + @@ -72048,7 +72048,7 @@ Decoys - + @@ -72116,7 +72116,7 @@ Detection of Malicious Code - + @@ -72134,7 +72134,7 @@

platform-independent applications to be included within organizational systems are defined;

- + @@ -72200,7 +72200,7 @@

information at rest requiring protection is defined;

- + @@ -72292,7 +72292,7 @@

system components or media requiring cryptographic protection is/are defined;

- + @@ -72362,7 +72362,7 @@

information to be removed from online storage and stored offline in a secure location is defined;

- + @@ -72438,7 +72438,7 @@

safeguards for protecting the storage of cryptographic keys are defined (if selected);

- + @@ -72499,7 +72499,7 @@

system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined;

- + @@ -72561,7 +72561,7 @@

the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined;

- + @@ -72641,7 +72641,7 @@

time periods to employ concealment and misdirection techniques for systems are defined;

- + @@ -72697,7 +72697,7 @@ Virtualization Techniques - + @@ -72714,7 +72714,7 @@

techniques employed to introduce randomness into organizational operations and assets are defined;

- + @@ -72790,7 +72790,7 @@

time frequency at which to change the location of processing and/or storage is defined (if selected);

- + @@ -72850,7 +72850,7 @@

system components for which realistic but misleading information about their security state or posture is employed are defined;

- + @@ -72917,7 +72917,7 @@

system components to be hidden or concealed using techniques (defined in SC-30(05)_ODP[01]) are defined;

- + @@ -72978,7 +72978,7 @@ timing - + @@ -73050,7 +73050,7 @@ Test Covert Channels for Exploitability - + @@ -73119,7 +73119,7 @@

values for the maximum bandwidth for identified covert channels are defined;

- + @@ -73183,7 +73183,7 @@

subset of identified covert channels whose bandwidth is to be measured in the operational environment of the system is defined;

- + @@ -73263,7 +73263,7 @@

circumstances for the physical or logical separation of components are defined;

- + @@ -73325,7 +73325,7 @@ Separate Physical Domains for Privileged Functions - + @@ -73381,7 +73381,7 @@ Transmission Preparation Integrity - + @@ -73406,7 +73406,7 @@

applications to be loaded and executed from hardware-enforced, read-only media are defined;

- + @@ -73490,7 +73490,7 @@

system components to be employed with no writeable storage are defined;

- + @@ -73546,7 +73546,7 @@ Integrity Protection on Read-only Media - + @@ -73615,7 +73615,7 @@ Hardware-based Protection - + @@ -73625,7 +73625,7 @@ External Malicious Code Identification - + @@ -73721,7 +73721,7 @@ logical domains - + @@ -73807,7 +73807,7 @@

actions to be taken in response to identified faults, errors, or compromise are defined;

- + @@ -73885,7 +73885,7 @@

duplicate systems or system components to be synchronized are defined;

- + @@ -73964,7 +73964,7 @@

individuals or systems to which physical delivery or electronic transmission of information, system components, or devices is to be achieved via the employment of out-of-band channels are defined;

- + @@ -74061,7 +74061,7 @@

information, system components, or devices that only individuals or systems are designated to receive are defined;

- + @@ -74130,7 +74130,7 @@

operations security controls to be employed to protect key organizational information throughout the system development life cycle are defined;

- + @@ -74196,7 +74196,7 @@ Process Isolation - + @@ -74250,7 +74250,7 @@ Hardware Separation - + @@ -74311,7 +74311,7 @@

multi-thread processing for which a separate execution domain is to be maintained for each thread is defined;

- + @@ -74405,7 +74405,7 @@

types of signal parameter attacks or references to sources for such attacks from which to protect internal wireless links are defined;

- + @@ -74478,7 +74478,7 @@

level of protection to be employed against the effects of intentional electromagnetic interference is defined;

- + @@ -74545,7 +74545,7 @@

the level of reduction to be achieved to reduce the detection potential of wireless links is defined;

- + @@ -74603,7 +74603,7 @@ Imitative or Manipulative Communications Deception - + @@ -74668,7 +74668,7 @@

wireless transmitters for which cryptographic mechanisms are to be implemented are defined;

- + @@ -74749,7 +74749,7 @@

systems or system components with connection ports or input/output devices to be disabled or removed are defined;

- + @@ -74843,7 +74843,7 @@

group of users to whom an explicit indication of sensor use is to be provided is defined;

- + @@ -74923,7 +74923,7 @@

sensors to be used to collect data or information are defined;

- + @@ -74987,7 +74987,7 @@

measures to be employed so that data or information collected by sensors is only used for authorized purposes are defined;

- + @@ -75045,7 +75045,7 @@ Prohibit Use of Devices - + @@ -75070,7 +75070,7 @@

sensors that collect personally identifiable information are defined;

- + @@ -75140,7 +75140,7 @@

the sensors that are configured to minimize the collection of unneeded information about individuals are defined;

- + @@ -75211,7 +75211,7 @@

the components for which usage restrictions and implementation guidance are to be established are defined;

- + @@ -75308,7 +75308,7 @@

the system, system component, or location where a detonation chamber capability is to be employed is defined;

- + @@ -75366,7 +75366,7 @@ System Time Synchronization - + @@ -75442,7 +75442,7 @@

the time period to compare the internal system clocks with the authoritative time source is defined;

- + @@ -75507,7 +75507,7 @@ Secondary Authoritative Time Source - + @@ -75581,7 +75581,7 @@ logically - + @@ -75641,7 +75641,7 @@

alternate communication paths for system operations and operational command and control are defined;

- + @@ -75719,7 +75719,7 @@

conditions or circumstances for relocating sensors and monitoring capabilities are defined;

- + @@ -75798,7 +75798,7 @@

conditions or circumstances for dynamically relocating sensors and monitoring capabilities are defined;

- + @@ -75860,7 +75860,7 @@

security domains requiring hardware-enforced separation and policy enforcement mechanisms are defined;

- + @@ -75922,7 +75922,7 @@

security domains requiring software-enforced separation and policy enforcement mechanisms are defined;

- + @@ -75995,7 +75995,7 @@

authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined;

- + @@ -76144,7 +76144,7 @@

events that would require the system and information integrity procedures to be reviewed and updated are defined;

- + @@ -76341,7 +76341,7 @@

time period within which to install security-relevant software updates after the release of the updates is defined;

- + @@ -76496,7 +76496,7 @@ Central Management - + @@ -76521,7 +76521,7 @@

the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined;

- + @@ -76583,7 +76583,7 @@

the benchmarks for taking corrective actions are defined;

- + @@ -76661,7 +76661,7 @@

the system components requiring automated patch management tools to facilitate flaw remediation are defined;

- + @@ -76734,7 +76734,7 @@

system components requiring security-relevant software updates to be automatically installed are defined;

- + @@ -76796,7 +76796,7 @@

software and firmware components to be removed after updated versions have been installed are defined;

- + @@ -76900,7 +76900,7 @@

personnel or roles to be alerted when malicious code is detected is/are defined;

- + @@ -77061,7 +77061,7 @@ Central Management - + @@ -77070,7 +77070,7 @@ Automatic Updates - + @@ -77079,7 +77079,7 @@ Non-privileged Users - + @@ -77088,7 +77088,7 @@ Updates Only by Privileged Users - + @@ -77145,7 +77145,7 @@ Portable Storage Devices - + @@ -77162,7 +77162,7 @@

the frequency at which to test malicious code protection mechanisms is defined;

- + @@ -77243,7 +77243,7 @@ Nonsignature-based Detection - + @@ -77277,7 +77277,7 @@ prevent the execution of the command - + @@ -77367,7 +77367,7 @@

tools and techniques to be employed to analyze the characteristics and behavior of malicious code are defined;

- + @@ -77502,7 +77502,7 @@

a frequency for providing system monitoring to personnel or roles is defined (if selected);

- + @@ -77722,7 +77722,7 @@ System-wide Intrusion Detection System - + @@ -77787,7 +77787,7 @@ Automated Tools and Mechanisms for Real-time Analysis - + @@ -77850,7 +77850,7 @@ Automated Tool and Mechanism Integration - + @@ -77957,7 +77957,7 @@

unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined;

- + @@ -78064,7 +78064,7 @@

compromise indicators are defined;

- + @@ -78127,7 +78127,7 @@ Restrict Non-privileged Users - + @@ -78154,7 +78154,7 @@

least-disruptive actions to terminate suspicious events are defined;

- + @@ -78230,7 +78230,7 @@ Protection of Monitoring Information - + @@ -78247,7 +78247,7 @@

a frequency at which to test intrusion-monitoring tools and mechanisms is defined;

- + @@ -78316,7 +78316,7 @@

system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined;

- + @@ -78381,7 +78381,7 @@

interior points within the system where communications traffic is to be analyzed are defined;

- + @@ -78473,7 +78473,7 @@

activities that trigger alerts to personnel or are defined;

- + @@ -78536,7 +78536,7 @@ Analyze Traffic and Event Patterns - + @@ -78647,7 +78647,7 @@ Wireless Intrusion Detection - + @@ -78719,7 +78719,7 @@ Wireless to Wireline Communications - + @@ -78777,7 +78777,7 @@ Correlate Monitoring Information - + @@ -78836,7 +78836,7 @@ Integrated Situational Awareness - + @@ -78908,7 +78908,7 @@

interior points within the system where communications traffic is to be analyzed are defined;

- + @@ -78992,7 +78992,7 @@

sources that identify individuals who pose an increased level of risk are defined;

- + @@ -79058,7 +79058,7 @@

additional monitoring of privileged users is defined;

- + @@ -79130,7 +79130,7 @@

the probationary period of individuals is defined;

- + @@ -79210,7 +79210,7 @@

personnel or roles to be alerted upon the detection of network services that have not been authorized or approved by authorization or approval processes is/are defined (if selected);

- + @@ -79303,7 +79303,7 @@

system components where host-based monitoring is to be implemented are defined;

- + @@ -79378,7 +79378,7 @@

personnel or roles to whom indicators of compromise are to be distributed is/are defined;

- + @@ -79451,7 +79451,7 @@ Optimize Network Traffic Analysis - + @@ -79563,7 +79563,7 @@

external organizations to whom security alerts, advisories, and directives are to be disseminated are defined (if selected);

- + @@ -79660,7 +79660,7 @@

automated mechanisms used to broadcast security alert and advisory information throughout the organization are defined;

- + @@ -79786,7 +79786,7 @@

alternative action(s) to be performed when anomalies are discovered are defined (if selected);

- + @@ -79907,7 +79907,7 @@ Notification of Failed Security Tests - + @@ -79916,7 +79916,7 @@ Automation Support for Distributed Testing - + @@ -79987,7 +79987,7 @@

personnel or roles designated to receive the results of security and privacy function verification is/are defined;

- + @@ -80107,7 +80107,7 @@

actions to be taken when unauthorized changes to information are detected are defined;

- + @@ -80350,7 +80350,7 @@

frequency with which to perform an integrity check (of information) is defined (if selected);

- + @@ -80425,7 +80425,7 @@

personnel or roles to whom notification is to be provided upon discovering discrepancies during integrity verification is/are defined;

- + @@ -80484,7 +80484,7 @@ Centrally Managed Integrity Tools - + @@ -80538,7 +80538,7 @@ Tamper-evident Packaging - + @@ -80564,7 +80564,7 @@

controls to be implemented automatically when integrity violations are discovered are defined (if selected);

- + @@ -80621,7 +80621,7 @@ Cryptographic Protection - + @@ -80701,7 +80701,7 @@

security-relevant changes to the system are defined;

- + @@ -80787,7 +80787,7 @@

other actions to be taken upon the detection of a potential integrity violation are defined (if selected);

- + @@ -80866,7 +80866,7 @@

system components requiring integrity verification of the boot process are defined;

- + @@ -80938,7 +80938,7 @@

system components requiring mechanisms to protect the integrity of boot firmware are defined;

- + @@ -80995,7 +80995,7 @@ Confined Environments with Limited Privileges - + @@ -81012,7 +81012,7 @@

user-installed software requiring integrity verification prior to execution is defined;

- + @@ -81066,7 +81066,7 @@ Code Execution in Protected Environments - + @@ -81075,7 +81075,7 @@ Binary or Machine Executable Code - + @@ -81092,7 +81092,7 @@

software or firmware components to be authenticated by cryptographic mechanisms prior to installation are defined;

- + @@ -81156,7 +81156,7 @@

the maximum time period permitted for processes to execute without supervision is defined;

- + @@ -81217,7 +81217,7 @@

controls to be implemented for application self-protection at runtime are defined;

- + @@ -81273,7 +81273,7 @@ Spam Protection - + @@ -81369,7 +81369,7 @@ Central Management - + @@ -81386,7 +81386,7 @@

the frequency at which to automatically update spam protection mechanisms is defined;

- + @@ -81440,7 +81440,7 @@ Continuous Learning Capability - + @@ -81494,7 +81494,7 @@ Information Input Restrictions - + @@ -81516,7 +81516,7 @@

information inputs to the system requiring validity checks are defined;

- + @@ -81579,7 +81579,7 @@

authorized individuals who can use the manual override capability are defined;

- + @@ -81683,7 +81683,7 @@

the time period within which input validation errors are to be resolved is defined;

- + @@ -81746,7 +81746,7 @@ Predictable Behavior - + @@ -81808,7 +81808,7 @@ Timing Interactions - + @@ -81877,7 +81877,7 @@

formats to which the use of information inputs is to be restricted are defined;

- + @@ -81934,7 +81934,7 @@ Injection Prevention - + @@ -82000,7 +82000,7 @@

personnel or roles to whom error messages are to be revealed is/are defined;

- + @@ -82074,7 +82074,7 @@ Information Management and Retention - + @@ -82191,7 +82191,7 @@

elements of personally identifiable information being processed in the information life cycle are defined;

- + @@ -82279,7 +82279,7 @@

techniques used to minimize the use of personally identifiable information for training are defined;

- + @@ -82382,7 +82382,7 @@

techniques used to erase information following the retention period are defined;

- + @@ -82474,7 +82474,7 @@

mean time to failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined;

- + @@ -82556,7 +82556,7 @@

the fraction or percentage of mean time to failure within which to transfer the responsibilities of a system component to a substitute component is defined;

- + @@ -82609,7 +82609,7 @@ Time Limit on Process Execution Without Supervision - + @@ -82626,7 +82626,7 @@

the percentage of the mean time to failure for transfers to be manually initiated is defined;

- + @@ -82711,7 +82711,7 @@

action to be taken when system component failures are detected is defined (if selected);

- + @@ -82800,7 +82800,7 @@

a failover capability for the system has been defined;

- + @@ -82882,7 +82882,7 @@

the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected);

- + @@ -82953,7 +82953,7 @@

trusted sources to obtain software and data for system component and service refreshes are defined;

- + @@ -83036,7 +83036,7 @@

the information to be generated is defined (if selected);

- + @@ -83111,7 +83111,7 @@ a period of non-use - + @@ -83181,7 +83181,7 @@

software programs and/or applications whose information output requires validation are defined;

- + @@ -83244,7 +83244,7 @@

controls to be implemented to protect the system memory from unauthorized code execution are defined;

- + @@ -83318,7 +83318,7 @@

a list of failure conditions requiring fail-safe procedures is defined;

- + @@ -83410,7 +83410,7 @@

the frequency at which to check the completeness of personally identifiable information across the information life cycle is defined;

- + @@ -83515,7 +83515,7 @@

automated mechanisms used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified are defined;

- + @@ -83574,7 +83574,7 @@ Data Tags - + @@ -83632,7 +83632,7 @@ Collection - + @@ -83686,7 +83686,7 @@ Individual Requests - + @@ -83750,7 +83750,7 @@

recipients of personally identifiable information to be notified when the personally identifiable information has been corrected or deleted are defined;

- + @@ -83823,7 +83823,7 @@

the frequency at which to evaluate the effectiveness of de-identification is defined;

- + @@ -83899,7 +83899,7 @@ Collection - + @@ -83953,7 +83953,7 @@ Archiving - + @@ -84007,7 +84007,7 @@ Release - + @@ -84061,7 +84061,7 @@ Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers - + @@ -84116,7 +84116,7 @@ Statistical Disclosure Control - + @@ -84185,7 +84185,7 @@ Differential Privacy - + @@ -84242,7 +84242,7 @@ Validated Algorithms and Software - + @@ -84304,7 +84304,7 @@ Motivated Intruder - + @@ -84367,7 +84367,7 @@

the systems or system components with data or capabilities to be embedded are defined;

- + @@ -84441,7 +84441,7 @@

the frequencies at which to refresh information are defined;

- + @@ -84524,7 +84524,7 @@

systems or system components that require an alternative information source for the execution of essential functions or services are defined;

- + @@ -84617,7 +84617,7 @@

systems or system components across which the fragmented information is to be distributed are defined;

- + @@ -84765,7 +84765,7 @@

events that require the supply chain risk management procedures to be reviewed and updated are defined;

- + @@ -84978,7 +84978,7 @@

the frequency at which to review and update the supply chain risk management plan is defined;

- + @@ -85162,7 +85162,7 @@

supply chain risk management activities are defined;

- + @@ -85252,7 +85252,7 @@

the document identifying the selected and implemented supply chain processes and controls is defined (if selected);

- + @@ -85393,7 +85393,7 @@

services with a diverse set of sources are defined;

- + @@ -85465,7 +85465,7 @@

controls to limit harm from potential supply chain adversaries are defined;

- + @@ -85527,7 +85527,7 @@ Sub-tier Flow Down - + @@ -85591,7 +85591,7 @@

systems, system components, and associated data that require valid provenance are defined;

- + @@ -85685,7 +85685,7 @@

supply chain elements, processes, and personnel associated with systems and critical system components that require unique identification are defined;

- + @@ -85758,7 +85758,7 @@

systems and critical system components that require unique identification for tracking through the supply chain are defined;

- + @@ -85843,7 +85843,7 @@

controls to validate that the system or system component received has not been altered are defined;

- + @@ -85932,7 +85932,7 @@

an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined;

- + @@ -86007,7 +86007,7 @@

acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined;

- + @@ -86116,7 +86116,7 @@

critical system components of which an adequate supply is required are defined;

- + @@ -86178,7 +86178,7 @@ Assessments Prior to Selection, Acceptance, Modification, or Update - + @@ -86264,7 +86264,7 @@

the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined;

- + @@ -86348,7 +86348,7 @@

supply chain elements, processes, and actors to be analyzed and tested are defined;

- + @@ -86413,7 +86413,7 @@

Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service are defined;

- + @@ -86493,7 +86493,7 @@

information for which agreements and procedures are to be established are defined (if selected);

- + @@ -86555,7 +86555,7 @@ Tamper Resistance and Detection - + @@ -86621,7 +86621,7 @@ Multiple Stages of System Development Life Cycle - + @@ -86717,7 +86717,7 @@

indications of the need for an inspection of systems or system components are defined (if selected);

- + @@ -86807,7 +86807,7 @@

personnel or roles to whom counterfeit system components are to be reported is/are defined (if selected);

- + @@ -86915,7 +86915,7 @@

personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware) is/are defined;

- + @@ -86979,7 +86979,7 @@

system components requiring configuration control are defined;

- + @@ -87053,7 +87053,7 @@

the frequency at which to scan for counterfeit system components is defined;

- + @@ -87129,7 +87129,7 @@

techniques and methods for disposing of data, documentation, tools, or system components are defined;

- + @@ -88548,7 +88548,7 @@ - NIST SP 800-53 Rev 5.1.1 content and other OSCAL content examples + NIST SP 800-53 Rev 5.1.1 content (with minor errors fixed) and other OSCAL content examples