+Electronic (OSCAL) Version of Enhanced Security Requirements for Protecting Controlled Unclassified Information v3.0.0
---+3.1 Access Control
------+03.01.01E Dual Authorization
------+03.01.02E Non-Organizationally Owned Systems - Restricted Use
------+03.01.03E
------+03.01.04E Concurrent Session Control
------+03.01.05E Remote Access Monitoring and Control
------+03.01.06E Protection of Remote Access Mechanism Information
------+03.01.07E Automated Audit Actions for Account Management
------+03.01.08E Account Monitoring for Atypical Usage
------+03.01.09E Attribute-Based Access Control
------+03.01.10E Object Security Attributes
------+03.01.11E Role-Based Access Control
------+03.01.12E Physical or Logical Separation of CUI Flows
------+03.01.13E Metadata
------+03.01.14E Security Policy Filters
------+03.01.15E Data Type Identifiers
------+03.01.16E Decomposition Into Policy-Relevant Subcomponents
------+03.01.17E Detection of Unsanctioned CUI
---+3.2 Awareness and Training
------+03.02.01E Advanced Literacy and Awareness Training
------+03.02.02E Literacy and Awareness Training Practical Exercises
------+03.02.03E Literacy and Awareness Training Feedback
------+03.02.04E Anti-Counterfeit Training
---+3.3 Audit and Accountability
------+03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components
------+03.03.02E Real-Time Alerts for Audit Processing Failures
------+03.03.03E Dual Authorization for Audit Information and Actions
------+03.03.04E Integrated Analysis of Audit Records
---+3.4 Configuration Management
------+03.04.01E
------+03.04.02E Automated Unauthorized Component Detection
------+03.04.03E Automated Maintenance of System Component Inventory
------+03.04.04E Automation Support for Baseline Configuration
------+03.04.05E Dual Authorization for System Changes
------+03.04.06E Retention of Previous Configurations
------+03.04.07E Testing, Validation, and Documentation of Changes
------+03.04.08E Centralized Repository
---+3.5 Identification and Authentication
------+03.05.01E Cryptographic Bidirectional Authentication
------+03.05.02E Password Managers
------+03.05.03E Device Attestation
------+03.05.04E No Embedded Unencrypted Static Authenticators
------+03.05.05E Expiration of Cached Authenticators
------+03.05.06E Identity Proofing
------+03.05.07E Identity Providers and Authorization Servers
---+3.6 Incident Response
------+03.06.01E Security Operations Center
------+03.06.02E Integrated Incident Response Team
------+03.06.03E Behavior Analysis
------+03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring
---+3.7 Maintenance
------+03.07.01E Software Updates and Patches for Maintenance Tools
---+3.8 Media Protection
------+03.08.01E Dual Authorization for Media Sanitization
------+03.08.02E Dual Authorization for System Backup Deletion and Destruction
------+03.08.03E Testing System Backups for Reliability and Integrity
------+03.08.04E System Recovery and Reconstitution
---+3.9 Personnel Security
------+03.09.01E
------+03.09.02E
------+03.09.03E Access Agreements
------+03.09.04E Citizenship Requirements
---+3.10 Physical Protection
------+03.10.01E Intrusion Alarms and Surveillance Equipment
------+03.10.02E Delivery and Removal of System Components
---+3.11 Risk Assessment
------+03.11.01E Threat Awareness Program
------+03.11.02E Threat Hunting
------+03.11.03E Predictive Cyber Analytics
------+03.11.04E
------+03.11.05E
------+03.11.06E
------+03.11.07E
------+03.11.08E Dynamic Threat Awareness
------+03.11.09E Indicators of Compromise
------+03.11.10E Criticality Analysis
------+03.11.11E Discoverable Information
------+03.11.12E Automated Means for Sharing Threat Intelligence
---+3.12 Security Assessment and Monitoring
------+03.12.01E Penetration Testing
------+03.12.02E Independent Assessors
------+03.12.03E Risk Monitoring
------+03.12.04E Internal System Connections
---+3.13 System and Communications Protection
------+03.13.01E Heterogeneity
------+03.13.02E Randomness
------+03.13.03E Concealment and Misdirection
------+03.13.04E Isolation of System Components
------+03.13.05E Change Processing and Storage Locations
------+03.13.06E Platform-Independent Applications
------+03.13.07E Virtualization Techniques
------+03.13.08E Decoys
------+03.13.09E Isolation of Security Tools, Mechanisms, and Support Components
------+03.13.10E Separate Subnetworks
------+03.13.11E Thin Nodes
------+03.13.12E Denial-of-Service Protection
------+03.13.13E Port and Input/Output Device Access
------+03.13.14E Detonation Chambers
------+03.13.15E Separate Subnets to Isolate System Components and Functions
------+03.13.16E System Partitioning
---+3.14 System and Information Integrity
------+03.14.01E Software, Firmware, and Information Integrity
------+03.14.02E
------+03.14.03E
------+03.14.04E Refresh From Trusted Sources
------+03.14.05E Non-Persistent Information
------+03.14.06E
------+03.14.07E
------+03.14.08E Integrity Checks
------+03.14.09E Cryptographic Protection
------+03.14.10E Protection of Boot Firmware
------+03.14.11E Integration of Detection and Response
------+03.14.12E Information Input Validation
------+03.14.13E Error Handling
------+03.14.14E Memory Protection
------+03.14.15E Non-Persistent System Components and Services
------+03.14.16E Tainting
------+03.14.17E System-Generated Alerts
------+03.14.18E Automated Organization-Generated Alerts
------+03.14.19E Wireless Intrusion Detection
---+3.15 Planning
------+03.15.01E Security Architecture
------+03.15.02E Defense In Depth
------+03.15.03E Supplier Diversity
---+3.16 System and Services Acquisition
------+03.16.01E Specialization
---+3.17 Supply Chain Risk Management
------+03.17.01E Notification Agreements
------+03.17.02E Inspection of Systems or Components
------+03.17.03E Component Authenticity
------+03.17.04E Provenance
------+03.17.05E Supply Chain Integrity – Pedigree
---+NIST SP 800-172 Rev. 3 – Assessment Procedures
------+03.01.01E Dual Authorization – Assessment Procedure
------+03.01.02E Non-Organizationally Owned Systems - Restricted Use – Assessment Procedure
------+03.01.04E Concurrent Session Control – Assessment Procedure
------+03.01.05E Remote Access Monitoring and Control – Assessment Procedure
------+03.01.06E Protection of Remote Access Mechanism Information – Assessment Procedure
------+03.01.07E Automated Audit Actions for Account Management – Assessment Procedure
------+03.01.08E Account Monitoring for Atypical Usage – Assessment Procedure
------+03.01.09E Attribute-Based Access Control – Assessment Procedure
------+03.01.10E Object Security Attributes – Assessment Procedure
------+03.01.11E Role-Based Access Control – Assessment Procedure
------+03.01.12E Physical or Logical Separation of CUI Flows – Assessment Procedure
------+03.01.13E Metadata – Assessment Procedure
------+03.01.14E Security Policy Filters – Assessment Procedure
------+03.01.15E Data Type Identifiers – Assessment Procedure
------+03.01.16E Decomposition Into Policy-Relevant Subcomponents – Assessment Procedure
------+03.01.17E Detection of Unsanctioned CUI – Assessment Procedure
------+03.02.01E Advanced Literacy and Awareness Training – Assessment Procedure
------+03.02.02E Literacy and Awareness Training Practical Exercises – Assessment Procedure
------+03.02.03E Literacy and Awareness Training Feedback – Assessment Procedure
------+03.02.04E Anti-Counterfeit Training – Assessment Procedure
------+03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components – Assessment Procedure
------+03.03.02E Real-Time Alerts for Audit Processing Failures – Assessment Procedure
------+03.03.03E Dual Authorization for Audit Information and Actions – Assessment Procedure
------+03.03.04E Integrated Analysis of Audit Records – Assessment Procedure
------+03.04.02E Automated Unauthorized Component Detection – Assessment Procedure
------+03.04.03E Automated Maintenance of System Component Inventory – Assessment Procedure
------+03.04.04E Automation Support for Baseline Configuration – Assessment Procedure
------+03.04.05E Dual Authorization for System Changes – Assessment Procedure
------+03.04.06E Retention of Previous Configurations – Assessment Procedure
------+03.04.07E Testing, Validation, and Documentation of Changes – Assessment Procedure
------+03.04.08E Centralized Repository – Assessment Procedure
------+03.05.01E Cryptographic Bidirectional Authentication – Assessment Procedure
------+03.05.02E Password Managers – Assessment Procedure
------+03.05.03E Device Attestation – Assessment Procedure
------+03.05.04E No Embedded Unencrypted Static Authenticators – Assessment Procedure
------+03.05.05E Expiration of Cached Authenticators – Assessment Procedure
------+03.05.06E Identity Proofing – Assessment Procedure
------+03.05.07E Identity Providers and Authorization Servers – Assessment Procedure
------+03.06.01E Security Operations Center – Assessment Procedure
------+03.06.02E Integrated Incident Response Team – Assessment Procedure
------+03.06.03E Behavior Analysis – Assessment Procedure
------+03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring – Assessment Procedure
------+03.07.01E Software Updates and Patches for Maintenance Tools – Assessment Procedure
------+03.08.01E Dual Authorization for Media Sanitization – Assessment Procedure
------+03.08.02E Dual Authorization for System Backup Deletion and Destruction – Assessment Procedure
------+03.08.03E Testing System Backups for Reliability and Integrity – Assessment Procedure
------+03.08.04E System Recovery and Reconstitution – Assessment Procedure
------+03.09.03E Access Agreements – Assessment Procedure
------+03.09.04E Citizenship Requirements – Assessment Procedure
------+03.10.01E Intrusion Alarms and Surveillance Equipment – Assessment Procedure
------+03.10.02E Delivery and Removal of System Components – Assessment Procedure
------+03.11.01E Threat Awareness Program – Assessment Procedure
------+03.11.02E Threat Hunting – Assessment Procedure
------+03.11.03E Predictive Cyber Analytics – Assessment Procedure
------+03.11.08E Dynamic Threat Awareness – Assessment Procedure
------+03.11.09E Indicators of Compromise – Assessment Procedure
------+03.11.10E Criticality Analysis – Assessment Procedure
------+03.11.11E Discoverable Information – Assessment Procedure
------+03.11.12E Automated Means for Sharing Threat Intelligence – Assessment Procedure
------+03.12.01E Penetration Testing – Assessment Procedure
------+03.12.02E Independent Assessors – Assessment Procedure
------+03.12.03E Risk Monitoring – Assessment Procedure
------+03.12.04E Internal System Connections – Assessment Procedure
------+03.13.01E Heterogeneity – Assessment Procedure
------+03.13.02E Randomness – Assessment Procedure
------+03.13.03E Concealment and Misdirection – Assessment Procedure
------+03.13.04E Isolation of System Components – Assessment Procedure
------+03.13.05E Change Processing and Storage Locations – Assessment Procedure
------+03.13.06E Platform-Independent Applications – Assessment Procedure
------+03.13.07E Virtualization Techniques – Assessment Procedure
------+03.13.08E Decoys – Assessment Procedure
------+03.13.09E Isolation of Security Tools, Mechanisms, and Support Components – Assessment Procedure
------+03.13.10E Separate Subnetworks – Assessment Procedure
------+03.13.11E Thin Nodes – Assessment Procedure
------+03.13.12E Denial-of-Service Protection – Assessment Procedure
------+03.13.13E Port and Input/Output Device Access – Assessment Procedure
------+03.13.14E Detonation Chambers – Assessment Procedure
------+03.13.15E Separate Subnets to Isolate System Components and Functions – Assessment Procedure
------+03.13.16E System Partitioning – Assessment Procedure
------+03.14.01E Software, Firmware, and Information Integrity – Assessment Procedure
------+03.14.04E Refresh From Trusted Sources – Assessment Procedure
------+03.14.05E Non-Persistent Information – Assessment Procedure
------+03.14.08E Integrity Checks – Assessment Procedure
------+03.14.09E Cryptographic Protection – Assessment Procedure
------+03.14.10E Protection of Boot Firmware – Assessment Procedure
------+03.14.11E Integration of Detection and Response – Assessment Procedure
------+03.14.12E Information Input Validation – Assessment Procedure
------+03.14.13E Error Handling – Assessment Procedure
------+03.14.14E Memory Protection – Assessment Procedure
------+03.14.15E Non-Persistent System Components and Services – Assessment Procedure
------+03.14.16E Tainting – Assessment Procedure
------+03.14.17E System-Generated Alerts – Assessment Procedure
------+03.14.18E Automated Organization-Generated Alerts – Assessment Procedure
------+03.14.19E Wireless Intrusion Detection – Assessment Procedure
------+03.15.01E Security Architecture – Assessment Procedure
------+03.15.02E Defense In Depth – Assessment Procedure
------+03.15.03E Supplier Diversity – Assessment Procedure
------+03.16.01E Specialization – Assessment Procedure
------+03.17.01E Notification Agreements – Assessment Procedure
------+03.17.02E Inspection of Systems or Components – Assessment Procedure
------+03.17.03E Component Authenticity – Assessment Procedure
------+03.17.04E Provenance – Assessment Procedure
------+03.17.05E Supply Chain Integrity – Pedigree – Assessment Procedure

Electronic (OSCAL) Version of Enhanced Security Requirements for Protecting Controlled Unclassified Information v3.0.0

Electronic (OSCAL) Version of Enhanced Security Requirements for Protecting Controlled Unclassified Information v3.0.0

1. Přehled

3.1 Access Control Access Control
3.2 Awareness and Training Awareness and Training
3.3 Audit and Accountability Audit and Accountability
3.4 Configuration Management Configuration Management
3.5 Identification and Authentication Identification and Authentication
3.6 Incident Response Incident Response
3.7 Maintenance Maintenance
3.8 Media Protection Media Protection
3.9 Personnel Security Personnel Security
3.10 Physical Protection Physical Protection
3.11 Risk Assessment Risk Assessment
3.12 Security Assessment and Monitoring Security Assessment and Monitoring
3.13 System and Communications Protection System and Communications Protection
3.14 System and Information Integrity System and Information Integrity
3.15 Planning Planning
3.16 System and Services Acquisition System and Services Acquisition
3.17 Supply Chain Risk Management Supply Chain Risk Management

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is related to English
is related to Imported: NIST SP 800-172 Rev. 3 (v1.5.0-da27cdb624)
is related to New version: NIST SP 800-172 Rev. 3 (v1.5.0-da27cdb624) – 104 new, 0 changed, 0 removed, 103 links
includes NIST SP 800-172 Rev. 3 – Assessment Procedures