NIST SP 800-53 Rev. 5 LOW Baseline – Assessment Procedures

The assessment objectives and methods of the controls, one assessment procedure per control, as the catalog has them.

Dílčí úkoly

Vazby
Název	Popis
AC-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: AC-01a. AC-01a.[01] an access control policy is developed and documented; AC-01a.[02] the access control policy is disseminated to [Assignment: personnel or roles]; AC-01a.[03] access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented; AC-01a.[04] the access control procedures are disseminated to [Assignment: personnel or roles]; AC-01a.01 AC-01a.01(a) AC-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses purpose; AC-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses scope; AC-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses roles; AC-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses responsibilities; AC-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses management commitment; AC-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses coordination among organizational entities; AC-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses compliance; AC-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; AC-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures; AC-01c. AC-01c.01 AC-01c.01[01] the current access control policy is reviewed and updated [Assignment: frequency]; AC-01c.01[02] the current access control policy is reviewed and updated following [Assignment: events]; AC-01c.02 AC-01c.02[01] the current access control procedures are reviewed and updated [Assignment: frequency]; AC-01c.02[02] the current access control procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Access control policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with access control responsibilities organizational personnel with information security with information security and privacy responsibilities
AC-02 [L] Account Management – Assessment Procedure	Assessment Objective Determine if: AC-02a. AC-02a.[01] account types allowed for use within the system are defined and documented; AC-02a.[02] account types specifically prohibited for use within the system are defined and documented; AC-02b. account managers are assigned; AC-02c. [Assignment: prerequisites and criteria] for group and role membership are required; AC-02d. AC-02d.01 authorized users of the system are specified; AC-02d.02 group and role membership are specified; AC-02d.03 AC-02d.03[01] access authorizations (i.e., privileges) are specified for each account; AC-02d.03[02] [Assignment: attributes (as required)] are specified for each account; AC-02e. approvals are required by [Assignment: personnel or roles] for requests to create accounts; AC-02f. AC-02f.[01] accounts are created in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[02] accounts are enabled in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[03] accounts are modified in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[04] accounts are disabled in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[05] accounts are removed in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02g. the use of accounts is monitored; AC-02h. AC-02h.01 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when accounts are no longer required; AC-02h.02 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when users are terminated or transferred; AC-02h.03 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when system usage or the need to know changes for an individual; AC-02i. AC-02i.01 access to the system is authorized based on a valid access authorization; AC-02i.02 access to the system is authorized based on intended system usage; AC-02i.03 access to the system is authorized based on [Assignment: attributes (as required)]; AC-02j. accounts are reviewed for compliance with account management requirements [Assignment: frequency]; AC-02k. AC-02k.[01] a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group; AC-02k.[02] a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group; AC-02l. AC-02l.[01] account management processes are aligned with personnel termination processes; AC-02l.[02] account management processes are aligned with personnel transfer processes. Assessment Methods Examine Access control policy personnel termination policy and procedure personnel transfer policy and procedure procedures for addressing account management system design documentation system configuration settings and associated documentation list of active system accounts along with the name of the individual associated with each account list of recently disabled system accounts and the name of the individual associated with each account list of conditions for group and role membership notifications of recent transfers, separations, or terminations of employees access authorization records account management compliance reviews system monitoring records system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security with information security and privacy responsibilities Test Organizational processes for account management on the system mechanisms for implementing account management
AC-03 [L] Access Enforcement – Assessment Procedure	Assessment Objective Determine if: AC-03 approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies. Assessment Methods Examine Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of approved authorizations (user privileges) system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security and privacy responsibilities system developers Test Mechanisms implementing access control policy
AC-07 [L] Unsuccessful Logon Attempts – Assessment Procedure	Assessment Objective Determine if: AC-07a. a limit of [Assignment: number] consecutive invalid logon attempts by a user during [Assignment: time period] is enforced; AC-07b. automatically [Selection (one or more): lock the account or node for [Assignment: time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: delay algorithm] ; notify system administrator; take other [Assignment: action] ] when the maximum number of unsuccessful attempts is exceeded. Assessment Methods Examine Access control policy procedures addressing unsuccessful logon attempts system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities system developers system/network administrators Test Mechanisms implementing access control policy for unsuccessful logon attempts
AC-08 [L] System Use Notification – Assessment Procedure	Assessment Objective Determine if: AC-08a. [Assignment: system use notification] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; AC-08a.01 the system use notification states that users are accessing a U.S. Government system; AC-08a.02 the system use notification states that system usage may be monitored, recorded, and subject to audit; AC-08a.03 the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and AC-08a.04 the system use notification states that use of the system indicates consent to monitoring and recording; AC-08b. the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; AC-08c. AC-08c.01 for publicly accessible systems, system use information [Assignment: conditions] is displayed before granting further access to the publicly accessible system; AC-08c.02 for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed; AC-08c.03 for publicly accessible systems, a description of the authorized uses of the system is included. Assessment Methods Examine Access control policy privacy and security policies, procedures addressing system use notification documented approval of system use notification messages or banners system audit records user acknowledgements of notification message or banner system design documentation system configuration settings and associated documentation system use notification messages system security plan privacy plan privacy impact assessment privacy assessment report other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy responsibilities legal counsel system developers Test Mechanisms implementing system use notification
AC-14 [L] Permitted Actions Without Identification or Authentication – Assessment Procedure	Assessment Objective Determine if: AC-14a. [Assignment: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified; AC-14b. AC-14b.[01] user actions not requiring identification or authentication are documented in the security plan for the system; AC-14b.[02] a rationale for user actions not requiring identification or authentication is provided in the security plan for the system. Assessment Methods Examine Access control policy procedures addressing permitted actions without identification or authentication system configuration settings and associated documentation security plan list of user actions that can be performed without identification or authentication system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities
AC-17 [L] Remote Access – Assessment Procedure	Assessment Objective Determine if: AC-17a. AC-17a.[01] usage restrictions are established and documented for each type of remote access allowed; AC-17a.[02] configuration/connection requirements are established and documented for each type of remote access allowed; AC-17a.[03] implementation guidance is established and documented for each type of remote access allowed; AC-17b. each type of remote access to the system is authorized prior to allowing such connections. Assessment Methods Examine Access control policy procedures addressing remote access implementation and usage (including restrictions) configuration management plan system configuration settings and associated documentation remote access authorizations system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for managing remote access connections system/network administrators organizational personnel with information security responsibilities Test Remote access management capability for the system
AC-18 [L] Wireless Access – Assessment Procedure	Assessment Objective Determine if: AC-18a. AC-18a.[01] configuration requirements are established for each type of wireless access; AC-18a.[02] connection requirements are established for each type of wireless access; AC-18a.[03] implementation guidance is established for each type of wireless access; AC-18b. each type of wireless access to the system is authorized prior to allowing such connections. Assessment Methods Examine Access control policy procedures addressing wireless access implementation and usage (including restrictions) configuration management plan system design documentation system configuration settings and associated documentation wireless access authorizations system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for managing wireless access connections organizational personnel with information security responsibilities Test Wireless access management capability for the system
AC-19 [L] Access Control for Mobile Devices – Assessment Procedure	Assessment Objective Determine if: AC-19a. AC-19a.[01] configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area; AC-19a.[02] connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area; AC-19a.[03] implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area; AC-19b. the connection of mobile devices to organizational systems is authorized. Assessment Methods Examine Access control policy procedures addressing access control for mobile device usage (including restrictions) configuration management plan system design documentation system configuration settings and associated documentation authorizations for mobile device connections to organizational systems system audit records system security plan other relevant documents or records Interview Organizational personnel using mobile devices to access organizational systems system/network administrators organizational personnel with information security responsibilities Test Access control capability for mobile device connections to organizational systems configurations of mobile devices
AC-20 [L] Use of External Systems – Assessment Procedure	Assessment Objective Determine if: AC-20a. AC-20a.01 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable); AC-20a.02 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable); AC-20b. the use of [Assignment: prohibited types of external systems] is prohibited (if applicable). Assessment Methods Examine Access control policy procedures addressing the use of external systems external systems terms and conditions list of types of applications accessible from external systems maximum security categorization for information processed, stored, or transmitted on external systems system configuration settings and associated documentation system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems system/network administrators organizational personnel with information security responsibilities Test Mechanisms implementing terms and conditions on the use of external systems
AC-22 [L] Publicly Accessible Content – Assessment Procedure	Assessment Objective Determine if: AC-22a. designated individuals are authorized to make information publicly accessible; AC-22b. authorized individuals are trained to ensure that publicly accessible information does not contain non-public information; AC-22c. the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included; AC-22d. AC-22d.[01] the content on the publicly accessible system is reviewed for non-public information [Assignment: frequency]; AC-22d.[02] non-public information is removed from the publicly accessible system, if discovered. Assessment Methods Examine Access control policy procedures addressing publicly accessible content list of users authorized to post publicly accessible content on organizational systems training materials and/or records records of publicly accessible information reviews records of response to non-public information on public websites system audit logs security awareness training records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for managing publicly accessible information posted on organizational systems organizational personnel with information security responsibilities Test Mechanisms implementing management of publicly accessible content
AT-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: AT-01a. AT-01a.[01] an awareness and training policy is developed and documented; AT-01a.[02] the awareness and training policy is disseminated to [Assignment: personnel or roles]; AT-01a.[03] awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented; AT-01a.[04] the awareness and training procedures are disseminated to [Assignment: personnel or roles]. AT-01a.01 AT-01a.01(a) AT-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses purpose; AT-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses scope; AT-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses roles; AT-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses responsibilities; AT-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses management commitment; AT-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses coordination among organizational entities; AT-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses compliance; and AT-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and AT-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures; AT-01c. AT-01c.01 AT-01c.01[01] the current awareness and training policy is reviewed and updated [Assignment: frequency]; AT-01c.01[02] the current awareness and training policy is reviewed and updated following [Assignment: events]; AT-01c.02 AT-01c.02[01] the current awareness and training procedures are reviewed and updated [Assignment: frequency]; AT-01c.02[02] the current awareness and training procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System security plan privacy plan awareness and training policy and procedures other relevant documents or records Interview Organizational personnel with awareness and training responsibilities organizational personnel with information security and privacy responsibilities
AT-02 [L] Literacy Training and Awareness – Assessment Procedure	Assessment Objective Determine if: AT-02a. AT-02a.01 AT-02a.01[01] security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users; AT-02a.01[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users; AT-02a.01[03] security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter; AT-02a.01[04] privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter; AT-02a.02 AT-02a.02[01] security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events]; AT-02a.02[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events]; AT-02b. [Assignment: awareness techniques] are employed to increase the security and privacy awareness of system users; AT-02c. AT-02c.[01] literacy training and awareness content is updated [Assignment: frequency]; AT-02c.[02] literacy training and awareness content is updated following [Assignment: events]; AT-02d. lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques. Assessment Methods Examine System security plan privacy plan literacy training and awareness policy procedures addressing literacy training and awareness implementation appropriate codes of federal regulations security and privacy literacy training curriculum security and privacy literacy training materials training records other relevant documents or records Interview Organizational personnel with responsibilities for literacy training and awareness organizational personnel with information security and privacy responsibilities organizational personnel comprising the general system user community Test Mechanisms managing information security and privacy literacy training
AT-02(02) [L] Insider Threat – Assessment Procedure	Assessment Objective Determine if: AT-02(02)[01] literacy training on recognizing potential indicators of insider threat is provided; AT-02(02)[02] literacy training on reporting potential indicators of insider threat is provided. Assessment Methods Examine System security plan privacy plan literacy training and awareness policy procedures addressing literacy training and awareness implementation literacy training and awareness curriculum literacy training and awareness materials other relevant documents or records Interview Organizational personnel who receive literacy training and awareness organizational personnel with responsibilities for literacy training and awareness organizational personnel with information security and privacy responsibilities
AT-03 [L] Role-based Training – Assessment Procedure	Assessment Objective Determine if: AT-03a. AT-03a.01 AT-03a.01[01] role-based security training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties; AT-03a.01[02] role-based privacy training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties; AT-03a.01[03] role-based security training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter; AT-03a.01[04] role-based privacy training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter; AT-03a.02 AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes; AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes; AT-03b. AT-03b.[01] role-based training content is updated [Assignment: frequency]; AT-03b.[02] role-based training content is updated following [Assignment: events]; AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training. Assessment Methods Examine System security plan privacy plan security and privacy awareness and training policy procedures addressing security and privacy training implementation codes of federal regulations security and privacy training curriculum security and privacy training materials training records other relevant documents or records Interview Organizational personnel with responsibilities for role-based security and privacy training organizational personnel with assigned system security and privacy roles and responsibilities Test Mechanisms managing role-based security and privacy training
AT-04 [L] Training Records – Assessment Procedure	Assessment Objective Determine if: AT-04a. AT-04a.[01] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented; AT-04a.[02] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored; AT-04b. individual training records are retained for [Assignment: time period]. Assessment Methods Examine Security and privacy awareness and training policy procedures addressing security and privacy training records security and privacy awareness and training records system security plan privacy plan other relevant documents or records Interview Organizational personnel with information security and privacy training record retention responsibilities Test Mechanisms supporting the management of security and privacy training records
AU-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: AU-01a. AU-01a.[01] an audit and accountability policy is developed and documented; AU-01a.[02] the audit and accountability policy is disseminated to [Assignment: personnel or roles]; AU-01a.[03] audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented; AU-01a.[04] the audit and accountability procedures are disseminated to [Assignment: personnel or roles]; AU-01a.01 AU-01a.01(a) AU-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose; AU-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope; AU-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles; AU-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities; AU-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment; AU-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities; AU-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance; AU-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; AU-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; AU-01c. AU-01c.01 AU-01c.01[01] the current audit and accountability policy is reviewed and updated [Assignment: frequency]; AU-01c.01[02] the current audit and accountability policy is reviewed and updated following [Assignment: events]; AU-01c.02 AU-01c.02[01] the current audit and accountability procedures are reviewed and updated [Assignment: frequency]; AU-01c.02[02] the current audit and accountability procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Audit and accountability policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities
AU-02 [L] Event Logging – Assessment Procedure	Assessment Objective Determine if: AU-02a. [Assignment: event types] that the system is capable of logging are identified in support of the audit logging function; AU-02b. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; AU-02c. AU-02c.[01] [Assignment: event types (subset of AU-02_ODP[01])] are specified for logging within the system; AU-02c.[02] the specified event types are logged within the system [Assignment: frequency or situation]; AU-02d. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; AU-02e. the event types selected for logging are reviewed and updated [Assignment: frequency]. Assessment Methods Examine Audit and accountability policy procedures addressing auditable events system security plan privacy plan system design documentation system configuration settings and associated documentation system audit records system auditable events other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms implementing system auditing
AU-03 [L] Content of Audit Records – Assessment Procedure	Assessment Objective Determine if: AU-03a. audit records contain information that establishes what type of event occurred; AU-03b. audit records contain information that establishes when the event occurred; AU-03c. audit records contain information that establishes where the event occurred; AU-03d. audit records contain information that establishes the source of the event; AU-03e. audit records contain information that establishes the outcome of the event; AU-03f. audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing content of audit records system design documentation system configuration settings and associated documentation list of organization-defined auditable events system audit records system incident reports other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms implementing system auditing of auditable events
AU-04 [L] Audit Log Storage Capacity – Assessment Procedure	Assessment Objective Determine if: AU-04 audit log storage capacity is allocated to accommodate [Assignment: audit log retention requirements]. Assessment Methods Examine Audit and accountability policy procedures addressing audit storage capacity system security plan privacy plan system design documentation system configuration settings and associated documentation audit record storage requirements audit record storage capability for system components system audit records other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Audit record storage capacity and related configuration settings
AU-05 [L] Response to Audit Logging Process Failures – Assessment Procedure	Assessment Objective Determine if: AU-05a. [Assignment: personnel or roles] are alerted in the event of an audit logging process failure within [Assignment: time period]; AU-05b. [Assignment: additional actions] are taken in the event of an audit logging process failure. Assessment Methods Examine Audit and accountability policy procedures addressing response to audit processing failures system design documentation system security plan privacy plan system configuration settings and associated documentation list of personnel to be notified in case of an audit processing failure system audit records other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing system response to audit processing failures
AU-06 [L] Audit Record Review, Analysis, and Reporting – Assessment Procedure	Assessment Objective Determine if: AU-06a. system audit records are reviewed and analyzed [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; AU-06b. findings are reported to [Assignment: personnel or roles]; AU-06c. the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing audit review, analysis, and reporting reports of audit findings records of actions taken in response to reviews/analyses of audit records other relevant documents or records Interview Organizational personnel with audit review, analysis, and reporting responsibilities organizational personnel with information security and privacy responsibilities
AU-08 [L] Time Stamps – Assessment Procedure	Assessment Objective Determine if: AU-08a. internal system clocks are used to generate timestamps for audit records; AU-08b. timestamps are recorded for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing timestamp generation system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing timestamp generation
AU-09 [L] Protection of Audit Information – Assessment Procedure	Assessment Objective Determine if: AU-09a. audit information and audit logging tools are protected from unauthorized access, modification, and deletion; AU-09b. [Assignment: personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information. Assessment Methods Examine Audit and accountability policy system security plan privacy plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system audit records audit tools other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing audit information protection
AU-11 [L] Audit Record Retention – Assessment Procedure	Assessment Objective Determine if: AU-11 audit records are retained for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. Assessment Methods Examine Audit and accountability policy system security plan privacy plan audit record retention policy and procedures security plan organization-defined retention period for audit records audit record archives audit logs audit records other relevant documents or records Interview Organizational personnel with audit record retention responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
AU-12 [L] Audit Record Generation – Assessment Procedure	Assessment Objective Determine if: AU-12a. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignment: system components]; AU-12b. [Assignment: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system; AU-12c. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated. Assessment Methods Examine Audit and accountability policy procedures addressing audit record generation system security plan privacy plan system design documentation system configuration settings and associated documentation list of auditable events system audit records other relevant documents or records Interview Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing audit record generation capability
CA-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: CA-01a. CA-01a.[01] an assessment, authorization, and monitoring policy is developed and documented; CA-01a.[02] the assessment, authorization, and monitoring policy is disseminated to [Assignment: personnel or roles]; CA-01a.[03] assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented; CA-01a.[04] the assessment, authorization, and monitoring procedures are disseminated to [Assignment: personnel or roles]; CA-01a.01 CA-01a.01(a) CA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses purpose; CA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses scope; CA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses roles; CA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses responsibilities; CA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses management commitment; CA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses coordination among organizational entities; CA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses compliance; CA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; CA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; CA-01c. CA-01c.01 CA-01c.01[01] the current assessment, authorization, and monitoring policy is reviewed and updated [Assignment: frequency]; CA-01c.01[02] the current assessment, authorization, and monitoring policy is reviewed and updated following [Assignment: events]; CA-01c.02 CA-01c.02[01] the current assessment, authorization, and monitoring procedures are reviewed and updated [Assignment: frequency]; CA-01c.02[02] the current assessment, authorization, and monitoring procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Assessment, authorization, and monitoring policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with assessment, authorization, and monitoring policy responsibilities organizational personnel with information security and privacy responsibilities
CA-02 [L] Control Assessments – Assessment Procedure	Assessment Objective Determine if: CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted; CA-02b. CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment; CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness; CA-02b.03 CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment; CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team; CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities; CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; CA-02d. CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements; CA-02e. a control assessment report is produced that documents the results of the assessment; CA-02f. the results of the control assessment are provided to [Assignment: individuals or roles]. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing assessment planning procedures addressing control assessments control assessment plan control assessment report system security plan privacy plan other relevant documents or records Interview Organizational personnel with control assessment responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting
CA-03 [L] Information Exchange – Assessment Procedure	Assessment Objective Determine if: CA-03a. the exchange of information between the system and other systems is approved and managed using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: type of agreement] ]; CA-03b. CA-03b.[01] the interface characteristics are documented as part of each exchange agreement; CA-03b.[02] security requirements are documented as part of each exchange agreement; CA-03b.[03] privacy requirements are documented as part of each exchange agreement; CA-03b.[04] controls are documented as part of each exchange agreement; CA-03b.[05] responsibilities for each system are documented as part of each exchange agreement; CA-03b.[06] the impact level of the information communicated is documented as part of each exchange agreement; CA-03c. agreements are reviewed and updated [Assignment: frequency]. Assessment Methods Examine Access control policy procedures addressing system connections system and communications protection policy system interconnection security agreements information exchange security agreements memoranda of understanding or agreements service level agreements non-disclosure agreements system design documentation enterprise architecture system architecture system configuration settings and associated documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements organizational personnel with information security and privacy responsibilities personnel managing the system(s) to which the interconnection security agreement applies
CA-05 [L] Plan of Action and Milestones – Assessment Procedure	Assessment Objective Determine if: CA-05a. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; CA-05b. existing plan of action and milestones are updated [Assignment: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing plan of action and milestones control assessment plan control assessment report control assessment evidence plan of action and milestones system security plan privacy plan other relevant documents or records Interview Organizational personnel with plan of action and milestones development and implementation responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms for developing, implementing, and maintaining plan of action and milestones
CA-06 [L] Authorization – Assessment Procedure	Assessment Objective Determine if: CA-06a. a senior official is assigned as the authorizing official for the system; CA-06b. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems; CA-06c. CA-06c.01 before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system; CA-06c.02 before commencing operations, the authorizing official for the system authorizes the system to operate; CA-06d. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; CA-06e. the authorizations are updated [Assignment: frequency]. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing authorization system security plan, privacy plan, assessment report, plan of action and milestones authorization statement other relevant documents or records Interview Organizational personnel with authorization responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms that facilitate authorizations and updates
CA-07 [L] Continuous Monitoring – Assessment Procedure	Assessment Objective Determine if: CA-07[01] a system-level continuous monitoring strategy is developed; CA-07[02] system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy; CA-07a. system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignment: system-level metrics]; CA-07b. CA-07b.[01] system-level continuous monitoring includes established [Assignment: frequencies] for monitoring; CA-07b.[02] system-level continuous monitoring includes established [Assignment: frequencies] for assessment of control effectiveness; CA-07c. system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy; CA-07d. system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; CA-07e. system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring; CA-07f. system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information; CA-07g. CA-07g.[01] system-level continuous monitoring includes reporting the security status of the system to [Assignment: personnel or roles] [Assignment: frequency]; CA-07g.[02] system-level continuous monitoring includes reporting the privacy status of the system to [Assignment: personnel or roles] [Assignment: frequency]. Assessment Methods Examine Assessment, authorization, and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system controls procedures addressing configuration management control assessment report plan of action and milestones system monitoring records configuration management records impact analyses status reports system security plan privacy plan other relevant documents or records Interview Organizational personnel with continuous monitoring responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms implementing continuous monitoring mechanisms supporting response actions to address assessment and monitoring results mechanisms supporting security and privacy status reporting
CA-07(04) [L] Risk Monitoring – Assessment Procedure	Assessment Objective Determine if: CA-07(04) risk monitoring is an integral part of the continuous monitoring strategy; CA-07(04)(a) effectiveness monitoring is included in risk monitoring; CA-07(04)(b) compliance monitoring is included in risk monitoring; CA-07(04)(c) change monitoring is included in risk monitoring. Assessment Methods Examine Assessment, authorization, and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system controls assessment report plan of action and milestones system monitoring records impact analyses status reports system security plan privacy plan other relevant documents or records Interview Organizational personnel with continuous monitoring responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms supporting risk monitoring
CA-09 [L] Internal System Connections – Assessment Procedure	Assessment Objective Determine if: CA-09a. internal connections of [Assignment: system components] to the system are authorized; CA-09b. CA-09b.[01] for each internal connection, the interface characteristics are documented; CA-09b.[02] for each internal connection, the security requirements are documented; CA-09b.[03] for each internal connection, the privacy requirements are documented; CA-09b.[04] for each internal connection, the nature of the information communicated is documented; CA-09c. internal system connections are terminated after [Assignment: conditions]; CA-09d. the continued need for each internal connection is reviewed [Assignment: frequency]. Assessment Methods Examine Assessment, authorization, and monitoring policy access control policy procedures addressing system connections system and communications protection policy system design documentation system configuration settings and associated documentation list of components or classes of components authorized as internal system connections assessment report system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections organizational personnel with information security and privacy responsibilities Test Mechanisms supporting internal system connections
CM-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: CM-01a. CM-01a.[01] a configuration management policy is developed and documented; CM-01a.[02] the configuration management policy is disseminated to [Assignment: personnel or roles]; CM-01a.[03] configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented; CM-01a.[04] the configuration management procedures are disseminated to [Assignment: personnel or roles]; CM-01a.01 CM-01a.01(a) CM-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses purpose; CM-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses scope; CM-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses roles; CM-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses responsibilities; CM-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses management commitment; CM-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses coordination among organizational entities; CM-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses compliance; CM-01a.01(b) the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; CM-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures; CM-01c. CM-01c.01 CM-01c.01[01] the current configuration management policy is reviewed and updated [Assignment: frequency]; CM-01c.01[02] the current configuration management policy is reviewed and updated following [Assignment: events]; CM-01c.02 CM-01c.02[01] the current configuration management procedures are reviewed and updated [Assignment: frequency]; CM-01c.02[02] the current configuration management procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Configuration management policy and procedures security and privacy program policies and procedures assessment or audit findings documentation of security incidents or breaches system security plan privacy plan risk management strategy other relevant artifacts, documents, or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities
CM-02 [L] Baseline Configuration – Assessment Procedure	Assessment Objective Determine if: CM-02a. CM-02a.[01] a current baseline configuration of the system is developed and documented; CM-02a.[02] a current baseline configuration of the system is maintained under configuration control; CM-02b. CM-02b.01 the baseline configuration of the system is reviewed and updated [Assignment: frequency]; CM-02b.02 the baseline configuration of the system is reviewed and updated when required due to [Assignment: circumstances]; CM-02b.03 the baseline configuration of the system is reviewed and updated when system components are installed or upgraded. Assessment Methods Examine Configuration management policy procedures addressing the baseline configuration of the system configuration management plan enterprise architecture documentation system design documentation system security plan privacy plan system architecture and configuration documentation system configuration settings and associated documentation system component inventory change control records other relevant documents or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for managing baseline configurations mechanisms supporting configuration control of the baseline configuration
CM-04 [L] Impact Analyses – Assessment Procedure	Assessment Objective Determine if: CM-04[01] changes to the system are analyzed to determine potential security impacts prior to change implementation; CM-04[02] changes to the system are analyzed to determine potential privacy impacts prior to change implementation. Assessment Methods Examine Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation, system design documentation analysis tools and associated outputs change control records system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibility for conducting security impact analyses organizational personnel with responsibility for conducting privacy impact analyses organizational personnel with information security and privacy responsibilities system developer system/network administrators members of change control board or similar Test Organizational processes for security impact analyses organizational processes for privacy impact analyses
CM-05 [L] Access Restrictions for Change – Assessment Procedure	Assessment Objective Determine if: CM-05[01] physical access restrictions associated with changes to the system are defined and documented; CM-05[02] physical access restrictions associated with changes to the system are approved; CM-05[03] physical access restrictions associated with changes to the system are enforced; CM-05[04] logical access restrictions associated with changes to the system are defined and documented; CM-05[05] logical access restrictions associated with changes to the system are approved; CM-05[06] logical access restrictions associated with changes to the system are enforced. Assessment Methods Examine Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing access restrictions to change mechanisms supporting, implementing, or enforcing access restrictions associated with changes to the system
CM-06 [L] Configuration Settings – Assessment Procedure	Assessment Objective Determine if: CM-06a. configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [Assignment: common secure configurations]; CM-06b. the configuration settings documented in CM-06a are implemented; CM-06c. CM-06c.[01] any deviations from established configuration settings for [Assignment: system components] are identified and documented based on [Assignment: operational requirements]; CM-06c.[02] any deviations from established configuration settings for [Assignment: system components] are approved; CM-06d. CM-06d.[01] changes to the configuration settings are monitored in accordance with organizational policies and procedures; CM-06d.[02] changes to the configuration settings are controlled in accordance with organizational policies and procedures. Assessment Methods Examine Configuration management policy procedures addressing configuration settings for the system configuration management plan system design documentation system configuration settings and associated documentation common secure configuration checklists system component inventory evidence supporting approved deviations from established configuration settings change control records system data processing and retention permissions system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with security configuration management responsibilities organizational personnel with privacy configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for managing configuration settings mechanisms that implement, monitor, and/or control system configuration settings mechanisms that identify and/or document deviations from established configuration settings
CM-07 [L] Least Functionality – Assessment Procedure	Assessment Objective Determine if: CM-07a. the system is configured to provide only [Assignment: mission-essential capabilities]; CM-07b. CM-07b.[01] the use of [Assignment: functions] is prohibited or restricted; CM-07b.[02] the use of [Assignment: ports] is prohibited or restricted; CM-07b.[03] the use of [Assignment: protocols] is prohibited or restricted; CM-07b.[04] the use of [Assignment: software] is prohibited or restricted; CM-07b.[05] the use of [Assignment: services] is prohibited or restricted. Assessment Methods Examine Configuration management policy procedures addressing least functionality in the system configuration management plan system design documentation system configuration settings and associated documentation system component inventory common secure configuration checklists system security plan other relevant documents or records Interview Organizational personnel with security configuration management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Organizational processes prohibiting or restricting functions, ports, protocols, software, and/or services mechanisms implementing restrictions or prohibition of functions, ports, protocols, software, and/or services
CM-08 [L] System Component Inventory – Assessment Procedure	Assessment Objective Determine if: CM-08a. CM-08a.01 an inventory of system components that accurately reflects the system is developed and documented; CM-08a.02 an inventory of system components that includes all components within the system is developed and documented; CM-08a.03 an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented; CM-08a.04 an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented; CM-08a.05 an inventory of system components that includes [Assignment: information] is developed and documented; CM-08b. the system component inventory is reviewed and updated [Assignment: frequency]. Assessment Methods Examine Configuration management policy procedures addressing system component inventory configuration management plan system security plan system design documentation system component inventory inventory reviews and update records system security plan other relevant documents or records Interview Organizational personnel with component inventory management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing the system component inventory mechanisms supporting and/or implementing system component inventory
CM-10 [L] Software Usage Restrictions – Assessment Procedure	Assessment Objective Determine if: CM-10a. software and associated documentation are used in accordance with contract agreements and copyright laws; CM-10b. the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution; CM-10c. the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. Assessment Methods Examine Configuration management policy software usage restrictions software contract agreements and copyright laws site license documentation list of software usage restrictions software license tracking reports configuration management plan system security plan system security plan other relevant documents or records Interview Organizational personnel operating, using, and/or maintaining the system organizational personnel with software license management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for tracking the use of software protected by quantity licenses organizational processes for controlling/documenting the use of peer-to-peer file sharing technology mechanisms implementing software license tracking mechanisms implementing and controlling the use of peer-to-peer files sharing technology
CM-11 [L] User-installed Software – Assessment Procedure	Assessment Objective Determine if: CM-11a. [Assignment: policies] governing the installation of software by users are established; CM-11b. software installation policies are enforced through [Assignment: methods]; CM-11c. compliance with [Assignment: policies] is monitored [Assignment: frequency]. Assessment Methods Examine Configuration management policy procedures addressing user-installed software configuration management plan system security plan system design documentation system configuration settings and associated documentation list of rules governing user installed software system monitoring records system audit records continuous monitoring strategy system security plan other relevant documents or records Interview Organizational personnel with responsibilities for governing user-installed software organizational personnel operating, using, and/or maintaining the system organizational personnel monitoring compliance with user-installed software policy organizational personnel with information security responsibilities system/network administrators Test Organizational processes governing user-installed software on the system mechanisms enforcing policies and methods for governing the installation of software by users mechanisms monitoring policy compliance
CP-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: CP-01a. CP-01a.[01] a contingency planning policy is developed and documented; CP-01a.[02] the contingency planning policy is disseminated to [Assignment: personnel or roles]; CP-01a.[03] contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented; CP-01a.[04] the contingency planning procedures are disseminated to [Assignment: personnel or roles]; CP-01a.01 CP-01a.01(a) CP-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses purpose; CP-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses scope; CP-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses roles; CP-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses responsibilities; CP-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses management commitment; CP-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses coordination among organizational entities; CP-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses compliance; CP-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; CP-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures; CP-01c. CP-01c.01 CP-01c.01[01] the current contingency planning policy is reviewed and updated [Assignment: frequency]; CP-01c.01[02] the current contingency planning policy is reviewed and updated following [Assignment: events]; CP-01c.02 CP-01c.02[01] the current contingency planning procedures are reviewed and updated [Assignment: frequency]; CP-01c.02[02] the current contingency planning procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Contingency planning policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities
CP-02 [L] Contingency Plan – Assessment Procedure	Assessment Objective Determine if: CP-02a. CP-02a.01 a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements; CP-02a.02 CP-02a.02[01] a contingency plan for the system is developed that provides recovery objectives; CP-02a.02[02] a contingency plan for the system is developed that provides restoration priorities; CP-02a.02[03] a contingency plan for the system is developed that provides metrics; CP-02a.03 CP-02a.03[01] a contingency plan for the system is developed that addresses contingency roles; CP-02a.03[02] a contingency plan for the system is developed that addresses contingency responsibilities; CP-02a.03[03] a contingency plan for the system is developed that addresses assigned individuals with contact information; CP-02a.04 a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; CP-02a.05 a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented; CP-02a.06 a contingency plan for the system is developed that addresses the sharing of contingency information; CP-02a.07 CP-02a.07[01] a contingency plan for the system is developed that is reviewed by [Assignment: personnel or roles]; CP-02a.07[02] a contingency plan for the system is developed that is approved by [Assignment: personnel or roles]; CP-02b. CP-02b.[01] copies of the contingency plan are distributed to [Assignment: key contingency personnel]; CP-02b.[02] copies of the contingency plan are distributed to [Assignment: organizational elements]; CP-02c. contingency planning activities are coordinated with incident handling activities; CP-02d. the contingency plan for the system is reviewed [Assignment: frequency]; CP-02e. CP-02e.[01] the contingency plan is updated to address changes to the organization, system, or environment of operation; CP-02e.[02] the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing; CP-02f. CP-02f.[01] contingency plan changes are communicated to [Assignment: key contingency personnel]; CP-02f.[02] contingency plan changes are communicated to [Assignment: organizational elements]; CP-02g. CP-02g.[01] lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing; CP-02g.[02] lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training; CP-02h. CP-02h.[01] the contingency plan is protected from unauthorized disclosure; CP-02h.[02] the contingency plan is protected from unauthorized modification. Assessment Methods Examine Contingency planning policy procedures addressing contingency operations for the system contingency plan evidence of contingency plan reviews and updates system security plan other relevant documents or records Interview Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with incident handling responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities Test Organizational processes for contingency plan development, review, update, and protection mechanisms for developing, reviewing, updating, and/or protecting the contingency plan
CP-03 [L] Contingency Training – Assessment Procedure	Assessment Objective Determine if: CP-03a. CP-03a.01 contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming a contingency role or responsibility; CP-03a.02 contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes; CP-03a.03 contingency training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter; CP-03b. CP-03b.[01] the contingency plan training content is reviewed and updated [Assignment: frequency]; CP-03b.[02] the contingency plan training content is reviewed and updated following [Assignment: events]. Assessment Methods Examine Contingency planning policy procedures addressing contingency training contingency plan contingency training curriculum contingency training material contingency training records system security plan other relevant documents or records Interview Organizational personnel with contingency planning, plan implementation, and training responsibilities organizational personnel with information security responsibilities Test Organizational processes for contingency training
CP-04 [L] Contingency Plan Testing – Assessment Procedure	Assessment Objective Determine if: CP-04a. CP-04a.[01] the contingency plan for the system is tested [Assignment: frequency]; CP-04a.[02] [Assignment: tests] are used to determine the effectiveness of the plan; CP-04a.[03] [Assignment: tests] are used to determine the readiness to execute the plan; CP-04b. the contingency plan test results are reviewed; CP-04c. corrective actions are initiated, if needed. Assessment Methods Examine Contingency planning policy procedures addressing contingency plan testing contingency plan contingency plan test documentation contingency plan test results system security plan other relevant documents or records Interview Organizational personnel with responsibilities for contingency plan testing, reviewing, or responding to contingency plan tests organizational personnel with information security responsibilities Test Organizational processes for contingency plan testing mechanisms supporting the contingency plan and/or contingency plan testing
CP-09 [L] System Backup – Assessment Procedure	Assessment Objective Determine if: CP-09a. backups of user-level information contained in [Assignment: system components] are conducted [Assignment: frequency]; CP-09b. backups of system-level information contained in the system are conducted [Assignment: frequency]; CP-09c. backups of system documentation, including security- and privacy-related documentation are conducted [Assignment: frequency]; CP-09d. CP-09d.[01] the confidentiality of backup information is protected; CP-09d.[02] the integrity of backup information is protected; CP-09d.[03] the availability of backup information is protected. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan backup storage location(s) system backup logs or records system security plan privacy plan other relevant documents or records Interview Organizational personnel with system backup responsibilities organizational personnel with information security and privacy responsibilities Test Organizational processes for conducting system backups mechanisms supporting and/or implementing system backups
CP-10 [L] System Recovery and Reconstitution – Assessment Procedure	Assessment Objective Determine if: CP-10[01] the recovery of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure; CP-10[02] a reconstitution of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test results contingency plan test documentation redundant secondary system for system backups location(s) of redundant secondary backup system(s) system security plan other relevant documents or records Interview Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities organizational personnel with information security responsibilities Test Organizational processes implementing system recovery and reconstitution operations mechanisms supporting and/or implementing system recovery and reconstitution operations
IA-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: IA-01a. IA-01a.[01] an identification and authentication policy is developed and documented; IA-01a.[02] the identification and authentication policy is disseminated to [Assignment: personnel or roles]; IA-01a.[03] identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed and documented; IA-01a.[04] the identification and authentication procedures are disseminated to [Assignment: personnel or roles]; IA-01a.01 IA-01a.01(a) IA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses purpose; IA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses scope; IA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses roles; IA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses responsibilities; IA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses management commitment; IA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses coordination among organizational entities; IA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses compliance; IA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; IA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; IA-01c. IA-01c.01 IA-01c.01[01] the current identification and authentication policy is reviewed and updated [Assignment: frequency]; IA-01c.01[02] the current identification and authentication policy is reviewed and updated following [Assignment: events]; IA-01c.02 IA-01c.02[01] the current identification and authentication procedures are reviewed and updated [Assignment: frequency]; IA-01c.02[02] the current identification and authentication procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Identification and authentication policy and procedures system security plan privacy plan risk management strategy documentation list of events requiring identification and authentication procedures to be reviewed and updated (e.g., audit findings) other relevant documents or records Interview Organizational personnel with identification and authentication responsibilities organizational personnel with information security and privacy responsibilities
IA-02 [L] Identification and Authentication (Organizational Users) – Assessment Procedure	Assessment Objective Determine if: IA-02[01] organizational users are uniquely identified and authenticated; IA-02[02] the unique identification of authenticated organizational users is associated with processes acting on behalf of those users. Assessment Methods Examine Identification and authentication policy procedures addressing user identification and authentication system security plan, system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators organizational personnel with account management responsibilities system developers Test Organizational processes for uniquely identifying and authenticating users mechanisms supporting and/or implementing identification and authentication capabilities
IA-02(01) [L] Multi-factor Authentication to Privileged Accounts – Assessment Procedure	Assessment Objective Determine if: IA-02(01) multi-factor authentication is implemented for access to privileged accounts. Assessment Methods Examine Identification and authentication policy procedures addressing user identification and authentication system security plan system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing a multi-factor authentication capability
IA-02(02) [L] Multi-factor Authentication to Non-privileged Accounts – Assessment Procedure	Assessment Objective Determine if: IA-02(02) multi-factor authentication for access to non-privileged accounts is implemented. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing a multi-factor authentication capability
IA-02(08) [L] Access to Accounts — Replay Resistant – Assessment Procedure	Assessment Objective Determine if: IA-02(08) replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts] are implemented. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of privileged system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing identification and authentication capabilities Mechanisms supporting and/or implementing replay-resistant authentication mechanisms
IA-02(12) [L] Acceptance of PIV Credentials – Assessment Procedure	Assessment Objective Determine if: IA-02(12) Personal Identity Verification-compliant credentials are accepted and electronically verified. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records PIV verification records evidence of PIV credentials PIV credential authorizations other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing acceptance and verification of PIV credentials
IA-04 [L] Identifier Management – Assessment Procedure	Assessment Objective Determine if: IA-04a. system identifiers are managed by receiving authorization from [Assignment: personnel or roles] to assign to an individual, group, role, or device identifier; IA-04b. system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device; IA-04c. system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device; IA-04d. system identifiers are managed by preventing reuse of identifiers for [Assignment: time period]. Assessment Methods Examine Identification and authentication policy procedures addressing identifier management procedures addressing account management system security plan system design documentation system configuration settings and associated documentation list of system accounts list of identifiers generated from physical access control devices other relevant documents or records Interview Organizational personnel with identifier management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing identifier management
IA-05 [L] Authenticator Management – Assessment Procedure	Assessment Objective Determine if: IA-05a. system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution; IA-05b. system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization; IA-05c. system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use; IA-05d. system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators; IA-05e. system authenticators are managed through the change of default authenticators prior to first use; IA-05f. system authenticators are managed through the change or refreshment of authenticators [Assignment: time period by authenticator type] or when [Assignment: events] occur; IA-05g. system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification; IA-05h. IA-05h.[01] system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators; IA-05h.[02] system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators; IA-05i. system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes. Assessment Methods Examine Identification and authentication policy system security plan addressing authenticator management system design documentation system configuration settings and associated documentation list of system authenticator types change control records associated with managing system authenticators system audit records other relevant documents or records Interview Organizational personnel with authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators Test Mechanisms supporting and/or implementing authenticator management capability
IA-05(01) [L] Password-based Authentication – Assessment Procedure	Assessment Objective Determine if: IA-05(01)(a) for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [Assignment: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly; IA-05(01)(b) for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a); IA-05(01)(c) for password-based authentication, passwords are only transmitted over cryptographically protected channels; IA-05(01)(d) for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash; IA-05(01)(e) for password-based authentication, immediate selection of a new password is required upon account recovery; IA-05(01)(f) for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters; IA-05(01)(g) for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators; IA-05(01)(h) for password-based authentication, [Assignment: composition and complexity rules] are enforced. Assessment Methods Examine Identification and authentication policy password policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation password configurations and associated documentation other relevant documents or records Interview Organizational personnel with authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing password-based authenticator management capability
IA-06 [L] Authentication Feedback – Assessment Procedure	Assessment Objective Determine if: IA-06 the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing authenticator feedback system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing the obscuring of feedback of authentication information during authentication
IA-07 [L] Cryptographic Module Authentication – Assessment Procedure	Assessment Objective Determine if: IA-07 mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing cryptographic module authentication system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with responsibility for cryptographic module authentication organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing cryptographic module authentication
IA-08 [L] Identification and Authentication (Non-organizational Users) – Assessment Procedure	Assessment Objective Determine if: IA-08 non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated. Assessment Methods Examine Identification and authentication policy system security plan privacy plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security and privacy responsibilities system/network administrators organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IA-08(01) [L] Acceptance of PIV Credentials from Other Agencies – Assessment Procedure	Assessment Objective Determine if: IA-08(01)[01] Personal Identity Verification-compliant credentials from other federal agencies are accepted; IA-08(01)[02] Personal Identity Verification-compliant credentials from other federal agencies are electronically verified. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records PIV verification records evidence of PIV credentials PIV credential authorizations other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities mechanisms that accept and verify PIV credentials
IA-08(02) [L] Acceptance of External Authenticators – Assessment Procedure	Assessment Objective Determine if: IA-08(02)(a) only external authenticators that are NIST-compliant are accepted; IA-08(02)(b) IA-08(02)(b)[01] a list of accepted external authenticators is documented; IA-08(02)(b)[02] a list of accepted external authenticators is maintained. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of third-party credentialing products, components, or services procured and implemented by organization third-party credential verification records evidence of third-party credentials third-party credential authorizations other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities mechanisms that accept external credentials
IA-08(04) [L] Use of Defined Profiles – Assessment Procedure	Assessment Objective Determine if: IA-08(04) there is conformance with [Assignment: identity management profiles] for identity management. Assessment Methods Examine Identification and authentication policy system security plan system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities mechanisms supporting and/or implementing conformance with profiles
IA-11 [L] Re-authentication – Assessment Procedure	Assessment Objective Determine if: IA-11 users are required to re-authenticate when [Assignment: circumstances or situations]. Assessment Methods Examine Identification and authentication policy procedures addressing user and device re-authentication system security plan system design documentation system configuration settings and associated documentation list of circumstances or situations requiring re-authentication system audit records other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IR-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: IR-01a. IR-01a.[01] an incident response policy is developed and documented; IR-01a.[02] the incident response policy is disseminated to [Assignment: personnel or roles]; IR-01a.[03] incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented; IR-01a.[04] the incident response procedures are disseminated to [Assignment: personnel or roles]; IR-01a.01 IR-01a.01(a) IR-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses purpose; IR-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses scope; IR-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses roles; IR-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses responsibilities; IR-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses management commitment; IR-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses coordination among organizational entities; IR-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses compliance; IR-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; IR-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures; IR-01c. IR-01c.01 IR-01c.01[01] the current incident response policy is reviewed and updated [Assignment: frequency]; IR-01c.01[02] the current incident response policy is reviewed and updated following [Assignment: events]; IR-01c.02 IR-01c.02[01] the current incident response procedures are reviewed and updated [Assignment: frequency]; IR-01c.02[02] the current incident response procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Incident response policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response responsibilities organizational personnel with information security and privacy responsibilities
IR-02 [L] Incident Response Training – Assessment Procedure	Assessment Objective Determine if: IR-02a. IR-02a.01 incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access; IR-02a.02 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes; IR-02a.03 incident response training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter; IR-02b. IR-02b.[01] incident response training content is reviewed and updated [Assignment: frequency]; IR-02b.[02] incident response training content is reviewed and updated following [Assignment: events]. Assessment Methods Examine Incident response policy procedures addressing incident response training incident response training curriculum incident response training materials privacy plan incident response plan incident response training records system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response training and operational responsibilities organizational personnel with information security and privacy responsibilities
IR-04 [L] Incident Handling – Assessment Procedure	Assessment Objective Determine if: IR-04a. IR-04a.[01] an incident handling capability for incidents is implemented that is consistent with the incident response plan; IR-04a.[02] the incident handling capability for incidents includes preparation; IR-04a.[03] the incident handling capability for incidents includes detection and analysis; IR-04a.[04] the incident handling capability for incidents includes containment; IR-04a.[05] the incident handling capability for incidents includes eradication; IR-04a.[06] the incident handling capability for incidents includes recovery; IR-04b. incident handling activities are coordinated with contingency planning activities; IR-04c. IR-04c.[01] lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing; IR-04c.[02] the changes resulting from the incorporated lessons learned are implemented accordingly; IR-04d. IR-04d.[01] the rigor of incident handling activities is comparable and predictable across the organization; IR-04d.[02] the intensity of incident handling activities is comparable and predictable across the organization; IR-04d.[03] the scope of incident handling activities is comparable and predictable across the organization; IR-04d.[04] the results of incident handling activities are comparable and predictable across the organization. Assessment Methods Examine Incident response policy contingency planning policy procedures addressing incident handling incident response plan contingency plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident handling responsibilities organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities Test Incident handling capability for the organization
IR-05 [L] Incident Monitoring – Assessment Procedure	Assessment Objective Determine if: IR-05[01] incidents are tracked; IR-05[02] incidents are documented. Assessment Methods Examine Incident response policy procedures addressing incident monitoring incident response records and documentation incident response plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident monitoring responsibilities organizational personnel with information security and privacy responsibilities Test Incident monitoring capability for the organization mechanisms supporting and/or implementing the tracking and documenting of system security incidents
IR-06 [L] Incident Reporting – Assessment Procedure	Assessment Objective Determine if: IR-06a. personnel is/are required to report suspected incidents to the organizational incident response capability within [Assignment: time period]; IR-06b. incident information is reported to [Assignment: authorities]. Assessment Methods Examine Incident response policy procedures addressing incident reporting incident reporting records and documentation incident response plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident reporting responsibilities organizational personnel with information security and privacy responsibilities personnel who have/should have reported incidents personnel (authorities) to whom incident information is to be reported system users Test Organizational processes for incident reporting mechanisms supporting and/or implementing incident reporting
IR-07 [L] Incident Response Assistance – Assessment Procedure	Assessment Objective Determine if: IR-07[01] an incident response support resource, integral to the organizational incident response capability, is provided; IR-07[02] the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents. Assessment Methods Examine Incident response policy procedures addressing incident response assistance incident response plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response assistance and support responsibilities organizational personnel with access to incident response support and assistance capability organizational personnel with information security and privacy responsibilities Test Organizational processes for incident response assistance mechanisms supporting and/or implementing incident response assistance
IR-08 [L] Incident Response Plan – Assessment Procedure	Assessment Objective Determine if: IR-08a. IR-08a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability; IR-08a.02 an incident response plan is developed that describes the structure and organization of the incident response capability; IR-08a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization; IR-08a.04 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions; IR-08a.05 an incident response plan is developed that defines reportable incidents; IR-08a.06 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization; IR-08a.07 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability; IR-08a.08 an incident response plan is developed that addresses the sharing of incident information; IR-08a.09 an incident response plan is developed that is reviewed and approved by [Assignment: personnel or roles] [Assignment: frequency]; IR-08a.10 an incident response plan is developed that explicitly designates responsibility for incident response to [Assignment: entities, personnel, or roles]. IR-08b. IR-08b.[01] copies of the incident response plan are distributed to [Assignment: incident response personnel]; IR-08b.[02] copies of the incident response plan are distributed to [Assignment: organizational elements]; IR-08c. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing; IR-08d. IR-08d.[01] incident response plan changes are communicated to [Assignment: incident response personnel]; IR-08d.[02] incident response plan changes are communicated to [Assignment: organizational elements]; IR-08e. IR-08e.[01] the incident response plan is protected from unauthorized disclosure; IR-08e.[02] the incident response plan is protected from unauthorized modification. Assessment Methods Examine Incident response policy procedures addressing incident response planning incident response plan system security plan privacy plan records of incident response plan reviews and approvals other relevant documents or records Interview Organizational personnel with incident response planning responsibilities organizational personnel with information security and privacy responsibilities Test Organizational incident response plan and related organizational processes
MA-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: MA-01a. MA-01a.[01] a maintenance policy is developed and documented; MA-01a.[02] the maintenance policy is disseminated to [Assignment: personnel or roles]; MA-01a.[03] maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented; MA-01a.[04] the maintenance procedures are disseminated to [Assignment: personnel or roles]; MA-01a.01 MA-01a.01(a) MA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses purpose; MA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses scope; MA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses roles; MA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses responsibilities; MA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses management commitment; MA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses coordination among organizational entities; MA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses compliance; MA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; MA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures; MA-01c. MA-01c.01 MA-01c.01[01] the current maintenance policy is reviewed and updated [Assignment: frequency]; MA-01c.01[02] the current maintenance policy is reviewed and updated following [Assignment: events]; MA-01c.02 MA-01c.02[01] the current maintenance procedures are reviewed and updated [Assignment: frequency]; MA-01c.02[02] the current maintenance procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Maintenance policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records Interview Organizational personnel with maintenance responsibilities organizational personnel with information security and privacy responsibilities
MA-02 [L] Controlled Maintenance – Assessment Procedure	Assessment Objective Determine if: MA-02a. MA-02a.[01] maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-02a.[02] maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-02a.[03] records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-02b. MA-02b.[01] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved; MA-02b.[02] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored; MA-02c. [Assignment: personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; MA-02d. equipment is sanitized to remove [Assignment: information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement; MA-02e. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; MA-02f. [Assignment: information] is included in organizational maintenance records. Assessment Methods Examine Maintenance policy procedures addressing controlled system maintenance maintenance records manufacturer/vendor maintenance specifications equipment sanitization records media sanitization records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities organizational personnel responsible for media sanitization system/network administrators Test Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system organizational processes for sanitizing system components mechanisms supporting and/or implementing controlled maintenance mechanisms implementing the sanitization of system components
MA-04 [L] Nonlocal Maintenance – Assessment Procedure	Assessment Objective Determine if: MA-04a. MA-04a.[01] nonlocal maintenance and diagnostic activities are approved; MA-04a.[02] nonlocal maintenance and diagnostic activities are monitored; MA-04b. MA-04b.[01] the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy; MA-04b.[02] the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system; MA-04c. strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions; MA-04d. records for nonlocal maintenance and diagnostic activities are maintained; MA-04e. MA-04e.[01] session connections are terminated when nonlocal maintenance is completed; MA-04e.[02] network connections are terminated when nonlocal maintenance is completed. Assessment Methods Examine Maintenance policy procedures addressing nonlocal system maintenance remote access policy remote access procedures system design documentation system configuration settings and associated documentation maintenance records records of remote access diagnostic records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing nonlocal maintenance mechanisms implementing, supporting, and/or managing nonlocal maintenance mechanisms for strong authentication of nonlocal maintenance diagnostic sessions mechanisms for terminating nonlocal maintenance sessions and network connections
MA-05 [L] Maintenance Personnel – Assessment Procedure	Assessment Objective Determine if: MA-05a. MA-05a.[01] a process for maintenance personnel authorization is established; MA-05a.[02] a list of authorized maintenance organizations or personnel is maintained; MA-05b. non-escorted personnel performing maintenance on the system possess the required access authorizations; MA-05c. organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations. Assessment Methods Examine Maintenance policy procedures addressing maintenance personnel service provider contracts service-level agreements list of authorized personnel maintenance records access control records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities Test Organizational processes for authorizing and managing maintenance personnel mechanisms supporting and/or implementing authorization of maintenance personnel
MP-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: MP-01a. MP-01a.[01] a media protection policy is developed and documented; MP-01a.[02] the media protection policy is disseminated to [Assignment: personnel or roles]; MP-01a.[03] media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented; MP-01a.[04] the media protection procedures are disseminated to [Assignment: personnel or roles]; MP-01a.01 MP-01a.01(a) MP-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses purpose; MP-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses scope; MP-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses roles; MP-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses responsibilities; MP-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses management commitment; MP-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses coordination among organizational entities; MP-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy compliance; MP-01a.01(b) the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; MP-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures. MP-01c. MP-01c.01 MP-01c.01[01] the current media protection policy is reviewed and updated [Assignment: frequency]; MP-01c.01[02] the current media protection policy is reviewed and updated following [Assignment: events]; MP-01c.02 MP-01c.02[01] the current media protection procedures are reviewed and updated [Assignment: frequency]; MP-01c.02[02] the current media protection procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Media protection policy and procedures organizational risk management strategy system security plan privacy plan other relevant documents or records Interview Organizational personnel with media protection responsibilities organizational personnel with information security and privacy responsibilities
MP-02 [L] Media Access – Assessment Procedure	Assessment Objective Determine if: MP-02[01] access to [Assignment: types of digital media] is restricted to [Assignment: personnel or roles]; MP-02[02] access to [Assignment: types of non-digital media] is restricted to [Assignment: personnel or roles]. Assessment Methods Examine System media protection policy procedures addressing media access restrictions access control policy and procedures physical and environmental protection policy and procedures media storage facilities access control records system security plan other relevant documents or records Interview Organizational personnel with system media protection responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for restricting information media mechanisms supporting and/or implementing media access restrictions
MP-06 [L] Media Sanitization – Assessment Procedure	Assessment Objective Determine if: MP-06a. MP-06a.[01] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to disposal; MP-06a.[02] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release from organizational control; MP-06a.[03] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release for reuse; MP-06b. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed. Assessment Methods Examine System media protection policy procedures addressing media sanitization and disposal applicable federal standards and policies addressing media sanitization policy media sanitization records system audit records system design documentation records retention and disposition policy records retention and disposition procedures system configuration settings and associated documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with media sanitization responsibilities organizational personnel with records retention and disposition responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for media sanitization mechanisms supporting and/or implementing media sanitization
MP-07 [L] Media Use – Assessment Procedure	Assessment Objective Determine if: MP-07a. the use of [Assignment: types of system media] is [Selection: restrict; prohibit] on [Assignment: systems or system components] using [Assignment: controls]; MP-07b. the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner. Assessment Methods Examine System media protection policy system use policy procedures addressing media usage restrictions rules of behavior system design documentation system configuration settings and associated documentation audit records system security plan other relevant documents or records Interview Organizational personnel with system media use responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for media use mechanisms restricting or prohibiting the use of system media on systems or system components
PE-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: PE-01a. PE-01a.[01] a physical and environmental protection policy is developed and documented; PE-01a.[02] the physical and environmental protection policy is disseminated to [Assignment: personnel or roles]; PE-01a.[03] physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented; PE-01a.[04] the physical and environmental protection procedures are disseminated to [Assignment: personnel or roles]; PE-01a.01 PE-01a.01(a) PE-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses purpose; PE-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses scope; PE-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses roles; PE-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses responsibilities; PE-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses management commitment; PE-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses coordination among organizational entities; PE-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses compliance; PE-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; PE-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; PE-01c. PE-01c.01 PE-01c.01[01] the current physical and environmental protection policy is reviewed and updated [Assignment: frequency]; PE-01c.01[02] the current physical and environmental protection policy is reviewed and updated following [Assignment: events]; PE-01c.02 PE-01c.02[01] the current physical and environmental protection procedures are reviewed and updated [Assignment: frequency]; PE-01c.02[02] the current physical and environmental protection procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Physical and environmental protection policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records Interview Organizational personnel with physical and environmental protection responsibilities organizational personnel with information security and privacy responsibilities
PE-02 [L] Physical Access Authorizations – Assessment Procedure	Assessment Objective Determine if: PE-02a. PE-02a.[01] a list of individuals with authorized access to the facility where the system resides has been developed; PE-02a.[02] the list of individuals with authorized access to the facility where the system resides has been approved; PE-02a.[03] the list of individuals with authorized access to the facility where the system resides has been maintained; PE-02b. authorization credentials are issued for facility access; PE-02c. the access list detailing authorized facility access by individuals is reviewed [Assignment: frequency]; PE-02d. individuals are removed from the facility access list when access is no longer required. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access authorizations authorized personnel access list authorization credentials physical access list reviews physical access termination records and associated documentation system security plan other relevant documents or records Interview Organizational personnel with physical access authorization responsibilities organizational personnel with physical access to system facility organizational personnel with information security responsibilities Test Organizational processes for physical access authorizations mechanisms supporting and/or implementing physical access authorizations
PE-03 [L] Physical Access Control – Assessment Procedure	Assessment Objective Determine if: PE-03a. PE-03a.01 physical access authorizations are enforced at [Assignment: entry and exit points] by verifying individual access authorizations before granting access to the facility; PE-03a.02 physical access authorizations are enforced at [Assignment: entry and exit points] by controlling ingress and egress to the facility using [Selection (one or more): [Assignment: systems or devices] ; guards]; PE-03b. physical access audit logs are maintained for [Assignment: entry or exit points]; PE-03c. access to areas within the facility designated as publicly accessible are maintained by implementing [Assignment: physical access controls]; PE-03d. PE-03d.[01] visitors are escorted; PE-03d.[02] visitor activity is controlled [Assignment: circumstances]; PE-03e. PE-03e.[01] keys are secured; PE-03e.[02] combinations are secured; PE-03e.[03] other physical access devices are secured; PE-03f. [Assignment: physical access devices] are inventoried [Assignment: frequency]; PE-03g. PE-03g.[01] combinations are changed [Assignment: frequency] , when combinations are compromised, or when individuals possessing the combinations are transferred or terminated; PE-03g.[02] keys are changed [Assignment: frequency] , when keys are lost, or when individuals possessing the keys are transferred or terminated. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access control physical access control logs or records inventory records of physical access control devices system entry and exit points records of key and lock combination changes storage locations for physical access control devices physical access control devices list of security safeguards controlling access to designated publicly accessible areas within facility system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities Test Organizational processes for physical access control mechanisms supporting and/or implementing physical access control physical access control devices
PE-06 [L] Monitoring Physical Access – Assessment Procedure	Assessment Objective Determine if: PE-06a. physical access to the facility where the system resides is monitored to detect and respond to physical security incidents; PE-06b. PE-06b.[01] physical access logs are reviewed [Assignment: frequency]; PE-06b.[02] physical access logs are reviewed upon occurrence of [Assignment: events]; PE-06c. PE-06c.[01] results of reviews are coordinated with organizational incident response capabilities; PE-06c.[02] results of investigations are coordinated with organizational incident response capabilities. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access monitoring physical access logs or records physical access monitoring records physical access log reviews system security plan other relevant documents or records Interview Organizational personnel with physical access monitoring responsibilities organizational personnel with incident response responsibilities organizational personnel with information security responsibilities Test Organizational processes for monitoring physical access mechanisms supporting and/or implementing physical access monitoring mechanisms supporting and/or implementing the review of physical access logs
PE-08 [L] Visitor Access Records – Assessment Procedure	Assessment Objective Determine if: PE-08a. visitor access records for the facility where the system resides are maintained for [Assignment: time period]; PE-08b. visitor access records are reviewed [Assignment: frequency]; PE-08c. visitor access records anomalies are reported to [Assignment: personnel]. Assessment Methods Examine Physical and environmental protection policy procedures addressing visitor access records visitor access control logs or records visitor access record or log reviews system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with visitor access record responsibilities organizational personnel with information security and privacy responsibilities Test Organizational processes for maintaining and reviewing visitor access records mechanisms supporting and/or implementing the maintenance and review of visitor access records
PE-12 [L] Emergency Lighting – Assessment Procedure	Assessment Objective Determine if: PE-12[01] automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system; PE-12[02] automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system; PE-12[03] automatic emergency lighting for the system covers emergency exits within the facility; PE-12[04] automatic emergency lighting for the system covers evacuation routes within the facility. Assessment Methods Examine Physical and environmental protection policy procedures addressing emergency lighting emergency lighting documentation emergency lighting test records emergency exits and evacuation routes system security plan other relevant documents or records Interview Organizational personnel with the responsibility for emergency lighting and/or planning organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing an emergency lighting capability
PE-13 [L] Fire Protection – Assessment Procedure	Assessment Objective Determine if: PE-13[01] fire detection systems are employed; PE-13[02] employed fire detection systems are supported by an independent energy source; PE-13[03] employed fire detection systems are maintained; PE-13[04] fire suppression systems are employed; PE-13[05] employed fire suppression systems are supported by an independent energy source; PE-13[06] employed fire suppression systems are maintained. Assessment Methods Examine Physical and environmental protection policy procedures addressing fire protection fire suppression and detection devices/systems fire suppression and detection devices/systems documentation test records of fire suppression and detection devices/systems system security plan other relevant documents or records Interview Organizational personnel with responsibilities for fire detection and suppression devices/systems organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing fire suppression/detection devices/systems
PE-14 [L] Environmental Controls – Assessment Procedure	Assessment Objective Determine if: PE-14a. [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: environmental control] ] levels are maintained at [Assignment: acceptable levels] within the facility where the system resides; PE-14b. environmental control levels are monitored [Assignment: frequency]. Assessment Methods Examine Physical and environmental protection policy procedures addressing temperature and humidity control temperature and humidity controls facility housing the system temperature and humidity controls documentation temperature and humidity records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing the maintenance and monitoring of temperature and humidity levels
PE-15 [L] Water Damage Protection – Assessment Procedure	Assessment Objective Determine if: PE-15[01] the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves; PE-15[02] the master shutoff or isolation valves are accessible; PE-15[03] the master shutoff or isolation valves are working properly; PE-15[04] the master shutoff or isolation valves are known to key personnel. Assessment Methods Examine Physical and environmental protection policy procedures addressing water damage protection facility housing the system master shutoff valves list of key personnel with knowledge of location and activation procedures for master shutoff valves for the plumbing system master shutoff valve documentation system security plan other relevant documents or records Interview Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities Test Master water-shutoff valves organizational process for activating master water shutoff
PE-16 [L] Delivery and Removal – Assessment Procedure	Assessment Objective Determine if: PE-16a. PE-16a.[01] [Assignment: types of system components] are authorized when entering the facility; PE-16a.[02] [Assignment: types of system components] are controlled when entering the facility; PE-16a.[03] [Assignment: types of system components] are authorized when exiting the facility; PE-16a.[04] [Assignment: types of system components] are controlled when exiting the facility; PE-16b. records of the system components are maintained. Assessment Methods Examine Physical and environmental protection policy procedures addressing the delivery and removal of system components from the facility facility housing the system records of items entering and exiting the facility system security plan other relevant documents or records Interview Organizational personnel with responsibilities for controlling system components entering and exiting the facility organizational personnel with information security responsibilities Test Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility
PL-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: PL-01a. PL-01a.[01] a planning policy is developed and documented. PL-01a.[02] the planning policy is disseminated to [Assignment: personnel or roles]; PL-01a.[03] planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented; PL-01a.[04] the planning procedures are disseminated to [Assignment: personnel or roles]; PL-01a.01 PL-01a.01(a) PL-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses purpose; PL-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses scope; PL-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses roles; PL-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses responsibilities; PL-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses management commitment; PL-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses coordination among organizational entities; PL-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses compliance; PL-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; PL-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the planning policy and procedures; PL-01c. PL-01c.01 PL-01c.01[01] the current planning policy is reviewed and updated [Assignment: frequency]; PL-01c.01[02] the current planning policy is reviewed and updated following [Assignment: events]; PL-01c.02 PL-01c.02[01] the current planning procedures are reviewed and updated [Assignment: frequency]; PL-01c.02[02] the current planning procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Planning policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with planning responsibilities organizational personnel with information security and privacy responsibilities
PL-02 [L] System Security and Privacy Plans – Assessment Procedure	Assessment Objective Determine if: PL-02a. PL-02a.01 PL-02a.01[01] a security plan for the system is developed that is consistent with the organization’s enterprise architecture; PL-02a.01[02] a privacy plan for the system is developed that is consistent with the organization’s enterprise architecture; PL-02a.02 PL-02a.02[01] a security plan for the system is developed that explicitly defines the constituent system components; PL-02a.02[02] a privacy plan for the system is developed that explicitly defines the constituent system components; PL-02a.03 PL-02a.03[01] a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes; PL-02a.03[02] a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes; PL-02a.04 PL-02a.04[01] a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities; PL-02a.04[02] a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities; PL-02a.05 PL-02a.05[01] a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system; PL-02a.05[02] a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system; PL-02a.06 PL-02a.06[01] a security plan for the system is developed that provides the security categorization of the system, including supporting rationale; PL-02a.06[02] a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale; PL-02a.07 PL-02a.07[01] a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization; PL-02a.07[02] a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization; PL-02a.08 PL-02a.08[01] a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information; PL-02a.08[02] a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information; PL-02a.09 PL-02a.09[01] a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components; PL-02a.09[02] a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components; PL-02a.10 PL-02a.10[01] a security plan for the system is developed that provides an overview of the security requirements for the system; PL-02a.10[02] a privacy plan for the system is developed that provides an overview of the privacy requirements for the system; PL-02a.11 PL-02a.11[01] a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable; PL-02a.11[02] a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable; PL-02a.12 PL-02a.12[01] a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions; PL-02a.12[02] a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions; PL-02a.13 PL-02a.13[01] a security plan for the system is developed that includes risk determinations for security architecture and design decisions; PL-02a.13[02] a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions; PL-02a.14 PL-02a.14[01] a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups]; PL-02a.14[02] a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups]; PL-02a.15 PL-02a.15[01] a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation; PL-02a.15[02] a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation. PL-02b. PL-02b.[01] copies of the plans are distributed to [Assignment: personnel or roles]; PL-02b.[02] subsequent changes to the plans are communicated to [Assignment: personnel or roles]; PL-02c. plans are reviewed [Assignment: frequency]; PL-02d. PL-02d.[01] plans are updated to address changes to the system and environment of operations; PL-02d.[02] plans are updated to address problems identified during the plan implementation; PL-02d.[03] plans are updated to address problems identified during control assessments; PL-02e. PL-02e.[01] plans are protected from unauthorized disclosure; PL-02e.[02] plans are protected from unauthorized modification. Assessment Methods Examine Security and privacy planning policy procedures addressing system security and privacy plan development and implementation procedures addressing security and privacy plan reviews and updates enterprise architecture documentation system security plan privacy plan records of system security and privacy plan reviews and updates security and privacy architecture and design documentation risk assessments risk assessment results control assessment documentation other relevant documents or records Interview Organizational personnel with system security and privacy planning and plan implementation responsibilities system developers organizational personnel with information security and privacy responsibilities Test Organizational processes for system security and privacy plan development, review, update, and approval mechanisms supporting the system security and privacy plan
PL-04 [L] Rules of Behavior – Assessment Procedure	Assessment Objective Determine if: PL-04a. PL-04a.[01] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system; PL-04a.[02] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system; PL-04b. before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received; PL-04c. rules of behavior are reviewed and updated [Assignment: frequency]; PL-04d. individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [Selection (one or more): [Assignment: frequency] ; when the rules are revised or updated]. Assessment Methods Examine Security and privacy planning policy procedures addressing rules of behavior for system users rules of behavior signed acknowledgements records for rules of behavior reviews and updates other relevant documents or records Interview Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior organizational personnel with responsibility for literacy training and awareness and role-based training organizational personnel who are authorized users of the system and have signed and resigned rules of behavior organizational personnel with information security and privacy responsibilities Test Organizational processes for establishing, reviewing, disseminating, and updating rules of behavior mechanisms supporting and/or implementing the establishment, review, dissemination, and update of rules of behavior
PL-04(01) [L] Social Media and External Site/Application Usage Restrictions – Assessment Procedure	Assessment Objective Determine if: PL-04(01)(a) the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications; PL-04(01)(b) the rules of behavior include restrictions on posting organizational information on public websites; PL-04(01)(c) the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications. Assessment Methods Examine Security and privacy planning policy procedures addressing rules of behavior for system users rules of behavior training policy other relevant documents or records Interview Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior organizational personnel with responsibility for literacy training and awareness and role-based training organizational personnel who are authorized users of the system and have signed rules of behavior organizational personnel with information security and privacy responsibilities Test Organizational processes for establishing rules of behavior mechanisms supporting and/or implementing the establishment of rules of behavior
PL-10 [L] Baseline Selection – Assessment Procedure	Assessment Objective Determine if: PL-10 a control baseline for the system is selected. Assessment Methods Examine Security and privacy planning policy procedures addressing system security and privacy plan development and implementation procedures addressing system security and privacy plan reviews and updates system design documentation system architecture and configuration documentation system categorization decision information types stored, transmitted, and processed by the system system element/component information stakeholder needs analysis list of security and privacy requirements allocated to the system, system elements, and environment of operation list of contractual requirements allocated to external providers of the system or system element business impact analysis or criticality analysis risk assessments risk management strategy organizational security and privacy policy federal or organization-approved or mandated baselines or overlays system security plan privacy plan other relevant documents or records Interview Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with responsibility for organizational risk management activities
PL-11 [L] Baseline Tailoring – Assessment Procedure	Assessment Objective Determine if: PL-11 the selected control baseline is tailored by applying specified tailoring actions. Assessment Methods Examine Security and privacy planning policy procedures addressing system security and privacy plan development and implementation system design documentation system categorization decision information types stored, transmitted, and processed by the system system element/component information stakeholder needs analysis list of security and privacy requirements allocated to the system, system elements, and environment of operation list of contractual requirements allocated to external providers of the system or system element business impact analysis or criticality analysis risk assessments risk management strategy organizational security and privacy policy federal or organization-approved or mandated baselines or overlays baseline tailoring rationale system security plan privacy plan records of system security and privacy plan reviews and updates other relevant documents or records Interview Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy responsibilities
PS-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: PS-01a. PS-01a.[01] a personnel security policy is developed and documented; PS-01a.[02] the personnel security policy is disseminated to [Assignment: personnel or roles]; PS-01a.[03] personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented; PS-01a.[04] the personnel security procedures are disseminated to [Assignment: personnel or roles]; PS-01a.01 PS-01a.01(a) PS-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses purpose; PS-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses scope; PS-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses roles; PS-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses responsibilities; PS-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses management commitment; PS-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses coordination among organizational entities; PS-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses compliance; PS-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; PS-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures; PS-01c. PS-01c.01 PS-01c.01[01] the current personnel security policy is reviewed and updated [Assignment: frequency]; PS-01c.01[02] the current personnel security policy is reviewed and updated following [Assignment: events]; PS-01c.02 PS-01c.02[01] the current personnel security procedures are reviewed and updated [Assignment: frequency]; PS-01c.02[02] the current personnel security procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Personnel security policy personnel security procedures system security plan privacy plan risk management strategy documentation audit findings other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-02 [L] Position Risk Designation – Assessment Procedure	Assessment Objective Determine if: PS-02a. a risk designation is assigned to all organizational positions; PS-02b. screening criteria are established for individuals filling organizational positions; PS-02c. position risk designations are reviewed and updated [Assignment: frequency]. Assessment Methods Examine Personnel security policy procedures addressing position categorization appropriate codes of federal regulations list of risk designations for organizational positions records of position risk designation reviews and updates system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities Test Organizational processes for assigning, reviewing, and updating position risk designations organizational processes for establishing screening criteria
PS-03 [L] Personnel Screening – Assessment Procedure	Assessment Objective Determine if: PS-03a. individuals are screened prior to authorizing access to the system; PS-03b. PS-03b.[01] individuals are rescreened in accordance with [Assignment: conditions requiring rescreening]; PS-03b.[02] where rescreening is so indicated, individuals are rescreened [Assignment: frequency]. Assessment Methods Examine Personnel security policy procedures addressing personnel screening records of screened personnel system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities Test Organizational processes for personnel screening
PS-04 [L] Personnel Termination – Assessment Procedure	Assessment Objective Determine if: PS-04a. upon termination of individual employment, system access is disabled within [Assignment: time period]; PS-04b. upon termination of individual employment, any authenticators and credentials are terminated or revoked; PS-04c. upon termination of individual employment, exit interviews that include a discussion of [Assignment: information security topics] are conducted; PS-04d. upon termination of individual employment, all security-related organizational system-related property is retrieved; PS-04e. upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained. Assessment Methods Examine Personnel security policy procedures addressing personnel termination records of personnel termination actions list of system accounts records of terminated or revoked authenticators/credentials records of exit interviews system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities Test Organizational processes for personnel termination mechanisms supporting and/or implementing personnel termination notifications mechanisms for disabling system access/revoking authenticators
PS-05 [L] Personnel Transfer – Assessment Procedure	Assessment Objective Determine if: PS-05a. the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization; PS-05b. [Assignment: transfer or reassignment actions] are initiated within [Assignment: time period following the formal transfer action]; PS-05c. access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer; PS-05d. [Assignment: personnel or roles] are notified within [Assignment: time period]. Assessment Methods Examine Personnel security policy procedures addressing personnel transfer records of personnel transfer actions list of system and facility access authorizations system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities Test Organizational processes for personnel transfer mechanisms supporting and/or implementing personnel transfer notifications mechanisms for disabling system access/revoking authenticators
PS-06 [L] Access Agreements – Assessment Procedure	Assessment Objective Determine if: PS-06a. access agreements are developed and documented for organizational systems; PS-06b. the access agreements are reviewed and updated [Assignment: frequency]; PS-06c. PS-06c.01 individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access; PS-06c.02 individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: frequency]. Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing access agreements for organizational information and systems access control policy access control procedures access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) documentation of access agreement reviews, updates, and re-signing system security plan privacy plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel who have signed/resigned access agreements organizational personnel with information security and privacy responsibilities Test Organizational processes for reviewing, updating, and re-signing access agreements mechanisms supporting the reviewing, updating, and re-signing of access agreements
PS-07 [L] External Personnel Security – Assessment Procedure	Assessment Objective Determine if: PS-07a. personnel security requirements are established, including security roles and responsibilities for external providers; PS-07b. external providers are required to comply with personnel security policies and procedures established by the organization; PS-07c. personnel security requirements are documented; PS-07d. external providers are required to notify [Assignment: personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [Assignment: time period]; PS-07e. provider compliance with personnel security requirements is monitored. Assessment Methods Examine Personnel security policy procedures addressing external personnel security list of personnel security requirements acquisition documents service-level agreements compliance monitoring process system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities external providers system/network administrators organizational personnel with account management responsibilities organizational personnel with information security responsibilities Test Organizational processes for managing and monitoring external personnel security mechanisms supporting and/or implementing the monitoring of provider compliance
PS-08 [L] Personnel Sanctions – Assessment Procedure	Assessment Objective Determine if: PS-08a. a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures; PS-08b. [Assignment: personnel or roles] is/are notified within [Assignment: time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction. Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing personnel sanctions access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) list of personnel or roles to be notified of formal employee sanctions records or notifications of formal employee sanctions system security plan privacy plan personally identifiable information processing policy other relevant documents or records Interview Organizational personnel with personnel security responsibilities legal counsel organizational personnel with information security and privacy responsibilities Test Organizational processes for managing formal employee sanctions mechanisms supporting and/or implementing formal employee sanctions notifications
PS-09 [L] Position Descriptions – Assessment Procedure	Assessment Objective Determine if: PS-09[01] security roles and responsibilities are incorporated into organizational position descriptions; PS-09[02] privacy roles and responsibilities are incorporated into organizational position descriptions. Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing position descriptions security and privacy position descriptions system security plan privacy plan privacy program plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with human capital management responsibilities Test Organizational processes for managing position descriptions
RA-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: RA-01a. RA-01a.[01] a risk assessment policy is developed and documented; RA-01a.[02] the risk assessment policy is disseminated to [Assignment: personnel or roles]; RA-01a.[03] risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented; RA-01a.[04] the risk assessment procedures are disseminated to [Assignment: personnel or roles]; RA-01a.01 RA-01a.01(a) RA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses purpose; RA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses scope; RA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses roles; RA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses responsibilities; RA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses management commitment; RA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses coordination among organizational entities; RA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses compliance; RA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; RA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures; RA-01c. RA-01c.01 RA-01c.01[01] the current risk assessment policy is reviewed and updated [Assignment: frequency]; RA-01c.01[02] the current risk assessment policy is reviewed and updated following [Assignment: events]; RA-01c.02 RA-01c.02[01] the current risk assessment procedures are reviewed and updated [Assignment: frequency]; RA-01c.02[02] the current risk assessment procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Risk assessment policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-02 [L] Security Categorization – Assessment Procedure	Assessment Objective Determine if: RA-02a. the system and the information it processes, stores, and transmits are categorized; RA-02b. the security categorization results, including supporting rationale, are documented in the security plan for the system; RA-02c. the authorizing official or authorizing official designated representative reviews and approves the security categorization decision. Assessment Methods Examine Risk assessment policy security planning policy and procedures procedures addressing security categorization of organizational information and systems security categorization documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with security categorization and risk assessment responsibilities organizational personnel with security and privacy responsibilities Test Organizational processes for security categorization
RA-03 [L] Risk Assessment – Assessment Procedure	Assessment Objective Determine if: RA-03a. RA-03a.01 a risk assessment is conducted to identify threats to and vulnerabilities in the system; RA-03a.02 a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information; RA-03a.03 a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; RA-03b. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments; RA-03c. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; [Assignment: document] ]; RA-03d. risk assessment results are reviewed [Assignment: frequency]; RA-03e. risk assessment results are disseminated to [Assignment: personnel or roles]; RA-03f. the risk assessment is updated [Assignment: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system. Assessment Methods Examine Risk assessment policy risk assessment procedures security and privacy planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates system security plan privacy plan other relevant documents or records Interview Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities Test Organizational processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
RA-03(01) [L] Supply Chain Risk Assessment – Assessment Procedure	Assessment Objective Determine if: RA-03(01)(a) supply chain risks associated with [Assignment: systems, system components, and system services] are assessed; RA-03(01)(b) the supply chain risk assessment is updated [Assignment: frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain. Assessment Methods Examine Supply chain risk management policy inventory of critical systems, system components, and system services risk assessment policy security planning policy and procedures procedures addressing organizational assessments of supply chain risk risk assessment risk assessment results risk assessment reviews risk assessment updates acquisition policy system security plan supply chain risk management plan other relevant documents or records Interview Organizational personnel with risk assessment responsibilities organizational personnel with security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the supply chain risk assessment
RA-05 [L] Vulnerability Monitoring and Scanning – Assessment Procedure	Assessment Objective Determine if: RA-05a. RA-05a.[01] systems and hosted applications are monitored for vulnerabilities [Assignment: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; RA-05a.[02] systems and hosted applications are scanned for vulnerabilities [Assignment: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; RA-05b. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools; RA-05b.01 vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations; RA-05b.02 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures; RA-05b.03 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact; RA-05c. vulnerability scan reports and results from vulnerability monitoring are analyzed; RA-05d. legitimate vulnerabilities are remediated [Assignment: response times] in accordance with an organizational assessment of risk; RA-05e. information obtained from the vulnerability monitoring process and control assessments is shared with [Assignment: personnel or roles] to help eliminate similar vulnerabilities in other systems; RA-05f. vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed. Assessment Methods Examine Risk assessment policy procedures addressing vulnerability scanning risk assessment assessment report vulnerability scanning tools and associated configuration documentation vulnerability scanning results patch and vulnerability management records system security plan other relevant documents or records Interview Organizational personnel with risk assessment, control assessment, and vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with vulnerability remediation responsibilities organizational personnel with security responsibilities system/network administrators Test Organizational processes for vulnerability scanning, analysis, remediation, and information sharing mechanisms supporting and/or implementing vulnerability scanning, analysis, remediation, and information sharing
RA-05(02) [L] Update Vulnerabilities to Be Scanned – Assessment Procedure	Assessment Objective Determine if: RA-05(02) the system vulnerabilities to be scanned are updated [Selection (one or more): [Assignment: frequency] ; prior to a new scan; when new vulnerabilities are identified and reported]. Assessment Methods Examine Procedures addressing vulnerability scanning assessment report vulnerability scanning tools and associated configuration documentation vulnerability scanning results patch and vulnerability management records system security plan other relevant documents or records Interview Organizational personnel with vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with security responsibilities system/network administrators Test Organizational processes for vulnerability scanning mechanisms/tools supporting and/or implementing vulnerability scanning
RA-05(11) [L] Public Disclosure Program – Assessment Procedure	Assessment Objective Determine if: RA-05(11) a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components. Assessment Methods Examine Risk assessment policy procedures addressing vulnerability scanning risk assessment vulnerability scanning tools and techniques documentation vulnerability scanning results vulnerability management records audit records public reporting channel system security plan other relevant documents or records Interview Organizational personnel with vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with security responsibilities Test Organizational processes for vulnerability scanning mechanisms/tools supporting and/or implementing vulnerability scanning mechanisms implementing the public reporting of vulnerabilities
RA-07 [L] Risk Response – Assessment Procedure	Assessment Objective Determine if: RA-07[01] findings from security assessments are responded to in accordance with organizational risk tolerance; RA-07[02] findings from privacy assessments are responded to in accordance with organizational risk tolerance; RA-07[03] findings from monitoring are responded to in accordance with organizational risk tolerance; RA-07[04] findings from audits are responded to in accordance with organizational risk tolerance. Assessment Methods Examine Risk assessment policy assessment reports audit records/event logs system security plan privacy plan other relevant documents or records Interview Organizational personnel with assessment and auditing responsibilities system/network administrators organizational personnel with security and privacy responsibilities Test Organizational processes for assessments and audits mechanisms/tools supporting and/or implementing assessments and auditing
SA-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SA-01a. SA-01a.[01] a system and services acquisition policy is developed and documented; SA-01a.[02] the system and services acquisition policy is disseminated to [Assignment: personnel or roles]; SA-01a.[03] system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented; SA-01a.[04] the system and services acquisition procedures are disseminated to [Assignment: personnel or roles]; SA-01a.01 SA-01a.01(a) SA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses purpose; SA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses scope; SA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses roles; SA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses responsibilities; SA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses management commitment; SA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses coordination among organizational entities; SA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses compliance; SA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; SA-01c. SA-01c.01 SA-01c.01[01] the system and services acquisition policy is reviewed and updated [Assignment: frequency]; SA-01c.01[02] the current system and services acquisition policy is reviewed and updated following [Assignment: events]; SA-01c.02 SA-01c.02[01] the current system and services acquisition procedures are reviewed and updated [Assignment: frequency]; SA-01c.02[02] the current system and services acquisition procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures supply chain risk management policy supply chain risk management procedures supply chain risk management plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SA-02 [L] Allocation of Resources – Assessment Procedure	Assessment Objective Determine if: SA-02a. SA-02a.[01] the high-level information security requirements for the system or system service are determined in mission and business process planning; SA-02a.[02] the high-level privacy requirements for the system or system service are determined in mission and business process planning; SA-02b. SA-02b.[01] the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process; SA-02b.[02] the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process; SA-02c. SA-02c.[01] a discrete line item for information security is established in organizational programming and budgeting documentation; SA-02c.[02] a discrete line item for privacy is established in organizational programming and budgeting documentation. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures system and services acquisition strategy and plans procedures addressing the allocation of resources to information security and privacy requirements procedures addressing capital planning and investment control organizational programming and budgeting documentation system security plan privacy plan supply chain risk management policy other relevant documents or records Interview Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for determining information security and privacy requirements organizational processes for capital planning, programming, and budgeting mechanisms supporting and/or implementing organizational capital planning, programming, and budgeting
SA-03 [L] System Development Life Cycle – Assessment Procedure	Assessment Objective Determine if: SA-03a. SA-03a.[01] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates information security considerations; SA-03a.[02] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates privacy considerations; SA-03b. SA-03b.[01] information security roles and responsibilities are defined and documented throughout the system development life cycle; SA-03b.[02] privacy roles and responsibilities are defined and documented throughout the system development life cycle; SA-03c. SA-03c.[01] individuals with information security roles and responsibilities are identified; SA-03c.[02] individuals with privacy roles and responsibilities are identified; SA-03d. SA-03d.[01] organizational information security risk management processes are integrated into system development life cycle activities; SA-03d.[02] organizational privacy risk management processes are integrated into system development life cycle activities. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process system development life cycle documentation organizational risk management strategy information security and privacy risk management strategy documentation system security plan privacy plan privacy program plan enterprise architecture documentation role-based security and privacy training program documentation data mapping documentation other relevant documents or records Interview Organizational personnel with information security and privacy responsibilities organizational personnel with system life cycle development responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for defining and documenting the system development life cycle organizational processes for identifying system development life cycle roles and responsibilities organizational processes for integrating information security and privacy and supply chain risk management into the system development life cycle mechanisms supporting and/or implementing the system development life cycle
SA-04 [L] Acquisition Process – Assessment Procedure	Assessment Objective Determine if: SA-04a. SA-04a.[01] security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04a.[02] privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04b. strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04c. SA-04c.[01] security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04c.[02] privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04d. SA-04d.[01] controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04d.[02] controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04e. SA-04e.[01] security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04e.[02] privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04f. SA-04f.[01] requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04f.[02] requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04g. the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04h. SA-04h.[01] the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04h.[02] the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ]; SA-04h.[03] the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ]; SA-04i. acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process configuration management plan acquisition contracts for the system, system component, or system service system design documentation system security plan supply chain risk management plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities system/network administrators organizational personnel with supply chain risk management responsibilities Test Organizational processes for determining system security and privacy functional, strength, and assurance requirements organizational processes for developing acquisition contracts mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
SA-04(10) [L] Use of Approved PIV Products – Assessment Procedure	Assessment Objective Determine if: SA-04(10) only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed. Assessment Methods Examine Supply chain risk management plan system and services acquisition policy procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process solicitation documentation acquisition documentation acquisition contracts for the system, system component, or system service service level agreements FIPS 201 approved products list system security plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility for determining system security requirements organizational personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented organizational personnel with information security responsibilities Test Organizational processes for selecting and employing FIPS 201-approved products
SA-05 [L] System Documentation – Assessment Procedure	Assessment Objective Determine if: SA-05a. SA-05a.01 SA-05a.01[01] administrator documentation for the system, system component, or system service that describes the secure configuration of the system, component, or service is obtained or developed; SA-05a.01[02] administrator documentation for the system, system component, or system service that describes the secure installation of the system, component, or service is obtained or developed; SA-05a.01[03] administrator documentation for the system, system component, or system service that describes the secure operation of the system, component, or service is obtained or developed; SA-05a.02 SA-05a.02[01] administrator documentation for the system, system component, or system service that describes the effective use of security functions and mechanisms is obtained or developed; SA-05a.02[02] administrator documentation for the system, system component, or system service that describes the effective maintenance of security functions and mechanisms is obtained or developed; SA-05a.02[03] administrator documentation for the system, system component, or system service that describes the effective use of privacy functions and mechanisms is obtained or developed; SA-05a.02[04] administrator documentation for the system, system component, or system service that describes the effective maintenance of privacy functions and mechanisms is obtained or developed; SA-05a.03 SA-05a.03[01] administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the configuration of administrative or privileged functions is obtained or developed; SA-05a.03[02] administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the use of administrative or privileged functions is obtained or developed; SA-05b. SA-05b.01 SA-05b.01[01] user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms is obtained or developed; SA-05b.01[02] user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible security) functions and mechanisms is obtained or developed; SA-05b.01[03] user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms is obtained or developed; SA-05b.01[04] user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible privacy) functions and mechanisms is obtained or developed; SA-05b.02 SA-05b.02[01] user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner is obtained or developed; SA-05b.02[02] user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service to protect individual privacy is obtained or developed; SA-05b.03 SA-05b.03[01] user documentation for the system, system component, or system service that describes user responsibilities for maintaining the security of the system, component, or service is obtained or developed; SA-05b.03[02] user documentation for the system, system component, or system service that describes user responsibilities for maintaining the privacy of individuals is obtained or developed; SA-05c. SA-05c.[01] attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented; SA-05c.[02] after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, [Assignment: actions] are taken in response; SA-05d. documentation is distributed to [Assignment: personnel or roles]. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing system documentation system documentation, including administrator and user guides system design documentation records documenting attempts to obtain unavailable or nonexistent system documentation list of actions to be taken in response to documented attempts to obtain system, system component, or system service documentation risk management strategy documentation system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities system administrators organizational personnel responsible for operating, using, and/or maintaining the system system developers Test Organizational processes for obtaining, protecting, and distributing system administrator and user documentation
SA-08 [L] Security and Privacy Engineering Principles – Assessment Procedure	Assessment Objective Determine if: SA-08[01] [Assignment: systems security engineering principles] are applied in the specification of the system and system components; SA-08[02] [Assignment: systems security engineering principles] are applied in the design of the system and system components; SA-08[03] [Assignment: systems security engineering principles] are applied in the development of the system and system components; SA-08[04] [Assignment: systems security engineering principles] are applied in the implementation of the system and system components; SA-08[05] [Assignment: systems security engineering principles] are applied in the modification of the system and system components; SA-08[06] [Assignment: privacy engineering principles] are applied in the specification of the system and system components; SA-08[07] [Assignment: privacy engineering principles] are applied in the design of the system and system components; SA-08[08] [Assignment: privacy engineering principles] are applied in the development of the system and system components; SA-08[09] [Assignment: privacy engineering principles] are applied in the implementation of the system and system components; SA-08[10] [Assignment: privacy engineering principles] are applied in the modification of the system and system components. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures assessment and authorization procedures procedures addressing security and privacy engineering principles used in the specification, design, development, implementation, and modification of the system system design documentation security and privacy requirements and specifications for the system system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with system specification, design, development, implementation, and modification responsibilities system developers Test Organizational processes for applying security and privacy engineering principles in system specification, design, development, implementation, and modification mechanisms supporting the application of security and privacy engineering principles in system specification, design, development, implementation, and modification
SA-09 [L] External System Services – Assessment Procedure	Assessment Objective Determine if: SA-09a. SA-09a.[01] providers of external system services comply with organizational security requirements; SA-09a.[02] providers of external system services comply with organizational privacy requirements; SA-09a.[03] providers of external system services employ [Assignment: controls]; SA-09b. SA-09b.[01] organizational oversight with regard to external system services are defined and documented; SA-09b.[02] user roles and responsibilities with regard to external system services are defined and documented; SA-09c. [Assignment: processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing methods and techniques for monitoring control compliance by external service providers of system services acquisition documentation contracts service level agreements interagency agreements licensing agreements list of organizational security and privacy requirements for external provider services control assessment results or reports from external providers of system services system security plan privacy plan supply chain risk management plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities external providers of system services organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis
SA-22 [L] Unsupported System Components – Assessment Procedure	Assessment Objective Determine if: SA-22a. system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer; SA-22b. [Selection (one or more): in-house support; [Assignment: support from external providers] ] provide options for alternative sources for continued support for unsupported components. Assessment Methods Examine System and services acquisition policy procedures addressing the replacement or continued use of unsupported system components documented evidence of replacing unsupported system components documented approvals (including justification) for the continued use of unsupported system components system security plan supply chain risk management plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with the responsibility for the system development life cycle organizational personnel responsible for component replacement Test Organizational processes for replacing unsupported system components mechanisms supporting and/or implementing the replacement of unsupported system components
SC-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SC-01a. SC-01a.[01] a system and communications protection policy is developed and documented; SC-01a.[02] the system and communications protection policy is disseminated to [Assignment: personnel or roles]; SC-01a.[03] system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented; SC-01a.[04] the system and communications protection procedures are disseminated to [Assignment: personnel or roles]; SC-01a.01 SC-01a.01(a) SC-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses purpose; SC-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses scope; SC-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses roles; SC-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses responsibilities; SC-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses management commitment; SC-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses coordination among organizational entities; SC-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses compliance; SC-01a.01(b) the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SC-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; SC-01c. SC-01c.01 SC-01c.01[01] the current system and communications protection policy is reviewed and updated [Assignment: frequency]; SC-01c.01[02] the current system and communications protection policy is reviewed and updated following [Assignment: events]; SC-01c.02 SC-01c.02[01] the current system and communications protection procedures are reviewed and updated [Assignment: frequency]; SC-01c.02[02] the current system and communications protection procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System and communications protection policy system and communications protection procedures system security plan privacy plan risk management strategy documentation audit findings other relevant documents or records Interview Organizational personnel with system and communications protection responsibilities organizational personnel with information security and privacy responsibilities
SC-05 [L] Denial-of-service Protection – Assessment Procedure	Assessment Objective Determine if: SC-05a. the effects of [Assignment: types of denial-of-service events] are [Selection: protect against; limit]; SC-05b. [Assignment: controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective. Assessment Methods Examine System and communications protection policy procedures addressing denial-of-service protection system design documentation list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks list of security safeguards protecting against or limiting the effects of denial-of-service attacks system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with incident response responsibilities system developer Test Mechanisms protecting against or limiting the effects of denial-of-service attacks
SC-07 [L] Boundary Protection – Assessment Procedure	Assessment Objective Determine if: SC-07a. SC-07a.[01] communications at external managed interfaces to the system are monitored; SC-07a.[02] communications at external managed interfaces to the system are controlled; SC-07a.[03] communications at key internal managed interfaces within the system are monitored; SC-07a.[04] communications at key internal managed interfaces within the system are controlled; SC-07b. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks; SC-07c. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection list of key internal boundaries of the system system design documentation boundary protection hardware and software system configuration settings and associated documentation enterprise security architecture documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities Test Mechanisms implementing boundary protection capabilities
SC-12 [L] Cryptographic Key Establishment and Management – Assessment Procedure	Assessment Objective Determine if: SC-12[01] cryptographic keys are established when cryptography is employed within the system in accordance with [Assignment: requirements]; SC-12[02] cryptographic keys are managed when cryptography is employed within the system in accordance with [Assignment: requirements]. Assessment Methods Examine System and communications protection policy procedures addressing cryptographic key establishment and management system design documentation cryptographic mechanisms system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for cryptographic key establishment and/or management Test Mechanisms supporting and/or implementing cryptographic key establishment and management
SC-13 [L] Cryptographic Protection – Assessment Procedure	Assessment Objective Determine if: SC-13a. [Assignment: cryptographic uses] are identified; SC-13b. [Assignment: types of cryptography] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented. Assessment Methods Examine System and communications protection policy procedures addressing cryptographic protection system design documentation system configuration settings and associated documentation cryptographic module validation certificates list of FIPS-validated cryptographic modules system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with responsibilities for cryptographic protection Test Mechanisms supporting and/or implementing cryptographic protection
SC-15 [L] Collaborative Computing Devices and Applications – Assessment Procedure	Assessment Objective Determine if: SC-15a. remote activation of collaborative computing devices and applications is prohibited except [Assignment: exceptions where remote activation is to be allowed]; SC-15b. an explicit indication of use is provided to users physically present at the devices. Assessment Methods Examine System and communications protection policy procedures addressing collaborative computing access control policy and procedures system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with responsibilities for managing collaborative computing devices Test Mechanisms supporting and/or implementing the management of remote activation of collaborative computing devices mechanisms providing an indication of use of collaborative computing devices
SC-20 [L] Secure Name/Address Resolution Service (Authoritative Source) – Assessment Procedure	Assessment Objective Determine if: SC-20a. SC-20a.[01] additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries; SC-20a.[02] integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries; SC-20b. SC-20b.[01] the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace; SC-20b.[02] the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided. Assessment Methods Examine System and communications protection policy procedures addressing secure name/address resolution services (authoritative source) system design documentation system configuration settings and associated documentation system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing DNS Test Mechanisms supporting and/or implementing secure name/address resolution services
SC-21 [L] Secure Name/Address Resolution Service (Recursive or Caching Resolver) – Assessment Procedure	Assessment Objective Determine if: SC-21[01] data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources; SC-21[02] data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources; SC-21[03] data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources; SC-21[04] data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources. Assessment Methods Examine System and communications protection policy procedures addressing secure name/address resolution services (recursive or caching resolver) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing DNS Test Mechanisms supporting and/or implementing data origin authentication and data integrity verification for name/address resolution services
SC-22 [L] Architecture and Provisioning for Name/Address Resolution Service – Assessment Procedure	Assessment Objective Determine if: SC-22[01] the systems that collectively provide name/address resolution services for an organization are fault-tolerant; SC-22[02] the systems that collectively provide name/address resolution services for an organization implement internal role separation; SC-22[03] the systems that collectively provide name/address resolution services for an organization implement external role separation. Assessment Methods Examine System and communications protection policy procedures addressing architecture and provisioning for name/address resolution services access control policy and procedures system design documentation assessment results from independent testing organizations system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing DNS Test Mechanisms supporting and/or implementing name/address resolution services for fault tolerance and role separation
SC-39 [L] Process Isolation – Assessment Procedure	Assessment Objective Determine if: SC-39 a separate execution domain is maintained for each executing system process. Assessment Methods Examine System design documentation system architecture independent verification and validation documentation testing and evaluation documentation other relevant documents or records Interview System developers/integrators system security architect Test Mechanisms supporting and/or implementing separate execution domains for each executing process
SI-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SI-01a. SI-01a.[01] a system and information integrity policy is developed and documented; SI-01a.[02] the system and information integrity policy is disseminated to [Assignment: personnel or roles]; SI-01a.[03] system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented; SI-01a.[04] the system and information integrity procedures are disseminated to [Assignment: personnel or roles]; SI-01a.01 SI-01a.01(a) SI-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses purpose; SI-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses scope; SI-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses roles; SI-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses responsibilities; SI-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses management commitment; SI-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses coordination among organizational entities; SI-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses compliance; SI-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SI-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; SI-01c. SI-01c.01 SI-01c.01[01] the current system and information integrity policy is reviewed and updated [Assignment: frequency]; SI-01c.01[02] the current system and information integrity policy is reviewed and updated following [Assignment: events]; SI-01c.02 SI-01c.02[01] the current system and information integrity procedures are reviewed and updated [Assignment: frequency]; SI-01c.02[02] the current system and information integrity procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System and information integrity policy system and information integrity procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with system and information integrity responsibilities organizational personnel with information security and privacy responsibilities
SI-02 [L] Flaw Remediation – Assessment Procedure	Assessment Objective Determine if: SI-02a. SI-02a.[01] system flaws are identified; SI-02a.[02] system flaws are reported; SI-02a.[03] system flaws are corrected; SI-02b. SI-02b.[01] software updates related to flaw remediation are tested for effectiveness before installation; SI-02b.[02] software updates related to flaw remediation are tested for potential side effects before installation; SI-02b.[03] firmware updates related to flaw remediation are tested for effectiveness before installation; SI-02b.[04] firmware updates related to flaw remediation are tested for potential side effects before installation; SI-02c. SI-02c.[01] security-relevant software updates are installed within [Assignment: time period] of the release of the updates; SI-02c.[02] security-relevant firmware updates are installed within [Assignment: time period] of the release of the updates; SI-02d. flaw remediation is incorporated into the organizational configuration management process. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing flaw remediation procedures addressing configuration management list of flaws and vulnerabilities potentially affecting the system list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws) test results from the installation of software and firmware updates to correct system flaws installation/change control records for security-relevant software and firmware updates system security plan privacy plan other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy responsibilities organizational personnel responsible for installing, configuring, and/or maintaining the system organizational personnel responsible for flaw remediation organizational personnel with configuration management responsibilities Test Organizational processes for identifying, reporting, and correcting system flaws organizational process for installing software and firmware updates mechanisms supporting and/or implementing the reporting and correcting of system flaws mechanisms supporting and/or implementing testing software and firmware updates
SI-03 [L] Malicious Code Protection – Assessment Procedure	Assessment Objective Determine if: SI-03a. SI-03a.[01] [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code; SI-03a.[02] [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code; SI-03b. malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures; SI-03c. SI-03c.01 SI-03c.01[01] malicious code protection mechanisms are configured to perform periodic scans of the system [Assignment: frequency]; SI-03c.01[02] malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; SI-03c.02 SI-03c.02[01] malicious code protection mechanisms are configured to [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: action] ] in response to malicious code detection; SI-03c.02[02] malicious code protection mechanisms are configured to send alerts to [Assignment: personnel or roles] in response to malicious code detection; SI-03d. the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed. Assessment Methods Examine System and information integrity policy system and information integrity procedures configuration management policy and procedures procedures addressing malicious code protection malicious code protection mechanisms records of malicious code protection updates system design documentation system configuration settings and associated documentation scan results from malicious code protection mechanisms record of actions initiated by malicious code protection mechanisms in response to malicious code detection system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for malicious code protection organizational personnel with configuration management responsibilities Test Organizational processes for employing, updating, and configuring malicious code protection mechanisms organizational processes for addressing false positives and resulting potential impacts mechanisms supporting and/or implementing, employing, updating, and configuring malicious code protection mechanisms mechanisms supporting and/or implementing malicious code scanning and subsequent actions
SI-04 [L] System Monitoring – Assessment Procedure	Assessment Objective Determine if: SI-04a. SI-04a.01 the system is monitored to detect attacks and indicators of potential attacks in accordance with [Assignment: monitoring objectives]; SI-04a.02 SI-04a.02[01] the system is monitored to detect unauthorized local connections; SI-04a.02[02] the system is monitored to detect unauthorized network connections; SI-04a.02[03] the system is monitored to detect unauthorized remote connections; SI-04b. unauthorized use of the system is identified through [Assignment: techniques and methods]; SI-04c. SI-04c.01 internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information; SI-04c.02 internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization; SI-04d. SI-04d.[01] detected events are analyzed; SI-04d.[02] detected anomalies are analyzed; SI-04e. the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; SI-04f. a legal opinion regarding system monitoring activities is obtained; SI-04g. [Assignment: system monitoring information] is provided to [Assignment: personnel or roles] [Selection (one or more): as needed; [Assignment: frequency] ]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques continuous monitoring strategy facility diagram/layout system design documentation system monitoring tools and techniques documentation locations within the system where monitoring devices are deployed system configuration settings and associated documentation system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system Test Organizational processes for system monitoring mechanisms supporting and/or implementing system monitoring capabilities
SI-05 [L] Security Alerts, Advisories, and Directives – Assessment Procedure	Assessment Objective Determine if: SI-05a. system security alerts, advisories, and directives are received from [Assignment: external organizations] on an ongoing basis; SI-05b. internal security alerts, advisories, and directives are generated as deemed necessary; SI-05c. security alerts, advisories, and directives are disseminated to [Selection (one or more): [Assignment: personnel or roles] ; [Assignment: elements] ; [Assignment: external organizations] ]; SI-05d. security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing security alerts, advisories, and directives records of security alerts and advisories system security plan other relevant documents or records Interview Organizational personnel with security alert and advisory responsibilities organizational personnel implementing, operating, maintaining, and using the system organizational personnel, organizational elements, and/or external organizations to whom alerts, advisories, and directives are to be disseminated system/network administrators organizational personnel with information security responsibilities Test Organizational processes for defining, receiving, generating, disseminating, and complying with security alerts, advisories, and directives mechanisms supporting and/or implementing the definition, receipt, generation, and dissemination of security alerts, advisories, and directives mechanisms supporting and/or implementing security directives
SI-12 [L] Information Management and Retention – Assessment Procedure	Assessment Objective Determine if: SI-12[01] information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements; SI-12[02] information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements; SI-12[03] information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements; SI-12[04] information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. Assessment Methods Examine System and information integrity policy system and information integrity procedures personally identifiable information processing policy records retention and disposition policy records retention and disposition procedures federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention media protection policy media protection procedures audit findings system security plan privacy plan privacy program plan personally identifiable information inventory privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with information and records management, retention, and disposition responsibilities organizational personnel with information security and privacy responsibilities network administrators Test Organizational processes for information management, retention, and disposition automated mechanisms supporting and/or implementing information management, retention, and disposition
SR-01 [L] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SR-01a. SR-01a.[01] a supply chain risk management policy is developed and documented; SR-01a.[02] the supply chain risk management policy is disseminated to [Assignment: personnel or roles]; SR-01a.[03] supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented; SR-01a.[04] the supply chain risk management procedures are disseminated to [Assignment: personnel or roles]. SR-01a.01 SR-01a.01(a) SR-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses purpose; SR-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses scope; SR-01a.01(a)[03] [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses roles; SR-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses responsibilities; SR-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses management commitment; SR-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses coordination among organizational entities; SR-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses compliance. SR-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SR-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; SR-01c. SR-01c.01 SR-01c.01[01] the current supply chain risk management policy is reviewed and updated [Assignment: frequency]; SR-01c.01[02] the current supply chain risk management policy is reviewed and updated following [Assignment: events]; SR-01c.02 SR-01c.02[01] the current supply chain risk management procedures are reviewed and updated [Assignment: frequency]; SR-01c.02[02] the current supply chain risk management procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with supply chain risk management responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with acquisition responsibilities organizational personnel with enterprise risk management responsibilities
SR-02 [L] Supply Chain Risk Management Plan – Assessment Procedure	Assessment Objective Determine if: SR-02a. SR-02a.[01] a plan for managing supply chain risks is developed; SR-02a.[02] the supply chain risk management plan addresses risks associated with the research and development of [Assignment: systems, system components, or system services]; SR-02a.[03] the supply chain risk management plan addresses risks associated with the design of [Assignment: systems, system components, or system services]; SR-02a.[04] the supply chain risk management plan addresses risks associated with the manufacturing of [Assignment: systems, system components, or system services]; SR-02a.[05] the supply chain risk management plan addresses risks associated with the acquisition of [Assignment: systems, system components, or system services]; SR-02a.[06] the supply chain risk management plan addresses risks associated with the delivery of [Assignment: systems, system components, or system services]; SR-02a.[07] the supply chain risk management plan addresses risks associated with the integration of [Assignment: systems, system components, or system services]; SR-02a.[08] the supply chain risk management plan addresses risks associated with the operation and maintenance of [Assignment: systems, system components, or system services]; SR-02a.[09] the supply chain risk management plan addresses risks associated with the disposal of [Assignment: systems, system components, or system services]; SR-02b. the supply chain risk management plan is reviewed and updated [Assignment: frequency] or as required to address threat, organizational, or environmental changes; SR-02c. SR-02c.[01] the supply chain risk management plan is protected from unauthorized disclosure; SR-02c.[02] the supply chain risk management plan is protected from unauthorized modification. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management plan system and services acquisition policy system and services acquisition procedures procedures addressing supply chain protection procedures for protecting the supply chain risk management plan from unauthorized disclosure and modification system development life cycle procedures procedures addressing the integration of information security and privacy requirements into the acquisition process acquisition documentation service level agreements acquisition contracts for the system, system component, or system service list of supply chain threats list of safeguards to be taken against supply chain threats system life cycle documentation inter-organizational agreements and procedures system security plan privacy plan privacy program plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for defining and documenting the system development life cycle (SDLC) organizational processes for identifying SDLC roles and responsibilities organizational processes for integrating supply chain risk management into the SDLC mechanisms supporting and/or implementing the SDLC
SR-02(01) [L] Establish SCRM Team – Assessment Procedure	Assessment Objective Determine if: SR-02(01) a supply chain risk management team consisting of [Assignment: personnel, roles and responsibilities] is established to lead and support [Assignment: supply chain risk management activities]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management team charter documentation supply chain risk management strategy supply chain risk management implementation plan procedures addressing supply chain protection system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with enterprise risk management responsibilities legal counsel organizational personnel with business continuity responsibilities
SR-03 [L] Supply Chain Controls and Processes – Assessment Procedure	Assessment Objective Determine if: SR-03a. SR-03a.[01] a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component]; SR-03a.[02] the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component] is/are coordinated with [Assignment: supply chain personnel]; SR-03b. [Assignment: supply chain controls] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events; SR-03c. the selected and implemented supply chain processes and controls are documented in [Selection (one or more): security and privacy plans; supply chain risk management plan; [Assignment: document] ]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management strategy supply chain risk management plan systems and critical system components inventory documentation system and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service level agreements acquisition contracts for systems or services risk register documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for identifying and addressing supply chain element and process deficiencies
SR-05 [L] Acquisition Strategies, Tools, and Methods – Assessment Procedure	Assessment Objective Determine if: SR-05[01] [Assignment: strategies, tools, and methods] are employed to protect against supply chain risks; SR-05[02] [Assignment: strategies, tools, and methods] are employed to identify supply chain risks; SR-05[03] [Assignment: strategies, tools, and methods] are employed to mitigate supply chain risks. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management plan system and services acquisition policy system and services acquisition procedures procedures addressing supply chain protection procedures addressing the integration of information security and privacy requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service level agreements acquisition contracts for systems, system components, or services documentation of training, education, and awareness programs for personnel regarding supply chain risk system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods mechanisms supporting and/or implementing the definition and employment of tailored acquisition strategies, contract tools, and procurement methods
SR-08 [L] Notification Agreements – Assessment Procedure	Assessment Objective Determine if: SR-08 agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Selection (one or more): notification of supply chain compromises; [Assignment: results of assessments or audits] ]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
SR-10 [L] Inspection of Systems or Components – Assessment Procedure	Assessment Objective Determine if: SR-10 [Assignment: systems or system components] are inspected [Selection (one or more): at random; at [Assignment: frequency] ; upon [Assignment: indications of need for inspection] ] to detect tampering. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy records of random inspections inspection reports/results assessment reports/results acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities organizational processes to inspect for tampering
SR-11 [L] Component Authenticity – Assessment Procedure	Assessment Objective Determine if: SR-11a. SR-11a.[01] an anti-counterfeit policy is developed and implemented; SR-11a.[02] anti-counterfeit procedures are developed and implemented; SR-11a.[03] the anti-counterfeit procedures include the means to detect counterfeit components entering the system; SR-11a.[04] the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system; SR-11b. counterfeit system components are reported to [Selection (one or more): source of counterfeit component; [Assignment: external reporting organizations] ; [Assignment: personnel or roles] ]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures records of reported counterfeit system components system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting Test Organizational processes for counterfeit prevention, detection, and reporting mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting
SR-11(01) [L] Anti-counterfeit Training – Assessment Procedure	Assessment Objective Determine if: SR-11(01) [Assignment: personnel or roles] are trained to detect counterfeit system components (including hardware, software, and firmware). Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy training materials addressing counterfeit system components training records on the detection and prevention of counterfeit components entering the system system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with responsibilities for anti-counterfeit policies, procedures, and training Test Organizational processes for anti-counterfeit training
SR-11(02) [L] Configuration Control for Component Service and Repair – Assessment Procedure	Assessment Objective Determine if: SR-11(02)[01] configuration control over [Assignment: system components] awaiting service or repair is maintained; SR-11(02)[02] configuration control over serviced or repaired [Assignment: system components] awaiting return to service is maintained. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan configuration control procedures acquisition documentation service level agreements acquisition contracts for the system component inter-organizational agreements and procedures system security plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities organizational configuration control processes
SR-12 [L] Component Disposal – Assessment Procedure	Assessment Objective Determine if: SR-12 [Assignment: data, documentation, tools, or system components] are disposed of using [Assignment: techniques and methods]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan disposal procedures addressing supply chain protection media disposal policy media protection policy disposal records for system components documentation of the system components identified for disposal documentation of the disposal techniques and methods employed for system components system security plan other relevant documents or records Interview Organizational personnel with system component disposal responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain protection responsibilities Test Organizational techniques and methods for system component disposal mechanisms supporting and/or implementing system component disposal

NIST -
https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Dílčí úkoly

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine