NIST SP 800-53 Rev. 5 MODERATE Baseline

The assessment objectives and methods of the controls, one assessment procedure per control, as the catalog has them.

Undersager

Sagslinks
Titel	Beskrivelse
AC-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: AC-01a. AC-01a.[01] an access control policy is developed and documented; AC-01a.[02] the access control policy is disseminated to [Assignment: personnel or roles]; AC-01a.[03] access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented; AC-01a.[04] the access control procedures are disseminated to [Assignment: personnel or roles]; AC-01a.01 AC-01a.01(a) AC-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses purpose; AC-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses scope; AC-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses roles; AC-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses responsibilities; AC-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses management commitment; AC-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses coordination among organizational entities; AC-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses compliance; AC-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; AC-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures; AC-01c. AC-01c.01 AC-01c.01[01] the current access control policy is reviewed and updated [Assignment: frequency]; AC-01c.01[02] the current access control policy is reviewed and updated following [Assignment: events]; AC-01c.02 AC-01c.02[01] the current access control procedures are reviewed and updated [Assignment: frequency]; AC-01c.02[02] the current access control procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Access control policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with access control responsibilities organizational personnel with information security with information security and privacy responsibilities
AC-02 [M] Account Management – Assessment Procedure	Assessment Objective Determine if: AC-02a. AC-02a.[01] account types allowed for use within the system are defined and documented; AC-02a.[02] account types specifically prohibited for use within the system are defined and documented; AC-02b. account managers are assigned; AC-02c. [Assignment: prerequisites and criteria] for group and role membership are required; AC-02d. AC-02d.01 authorized users of the system are specified; AC-02d.02 group and role membership are specified; AC-02d.03 AC-02d.03[01] access authorizations (i.e., privileges) are specified for each account; AC-02d.03[02] [Assignment: attributes (as required)] are specified for each account; AC-02e. approvals are required by [Assignment: personnel or roles] for requests to create accounts; AC-02f. AC-02f.[01] accounts are created in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[02] accounts are enabled in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[03] accounts are modified in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[04] accounts are disabled in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02f.[05] accounts are removed in accordance with [Assignment: policy, procedures, prerequisites, and criteria]; AC-02g. the use of accounts is monitored; AC-02h. AC-02h.01 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when accounts are no longer required; AC-02h.02 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when users are terminated or transferred; AC-02h.03 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when system usage or the need to know changes for an individual; AC-02i. AC-02i.01 access to the system is authorized based on a valid access authorization; AC-02i.02 access to the system is authorized based on intended system usage; AC-02i.03 access to the system is authorized based on [Assignment: attributes (as required)]; AC-02j. accounts are reviewed for compliance with account management requirements [Assignment: frequency]; AC-02k. AC-02k.[01] a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group; AC-02k.[02] a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group; AC-02l. AC-02l.[01] account management processes are aligned with personnel termination processes; AC-02l.[02] account management processes are aligned with personnel transfer processes. Assessment Methods Examine Access control policy personnel termination policy and procedure personnel transfer policy and procedure procedures for addressing account management system design documentation system configuration settings and associated documentation list of active system accounts along with the name of the individual associated with each account list of recently disabled system accounts and the name of the individual associated with each account list of conditions for group and role membership notifications of recent transfers, separations, or terminations of employees access authorization records account management compliance reviews system monitoring records system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security with information security and privacy responsibilities Test Organizational processes for account management on the system mechanisms for implementing account management
AC-02(01) [M] Automated System Account Management – Assessment Procedure	Assessment Objective Determine if: AC-02(01) the management of system accounts is supported using [Assignment: automated mechanisms]. Assessment Methods Examine Access control policy procedures for addressing account management system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security with information security responsibilities system developers Test Automated mechanisms for implementing account management functions
AC-02(02) [M] Automated Temporary and Emergency Account Management – Assessment Procedure	Assessment Objective Determine if: AC-02(02) temporary and emergency accounts are automatically [Selection: remove; disable] after [Assignment: time period]. Assessment Methods Examine Access control policy procedures for addressing account management system design documentation system configuration settings and associated documentation system-generated list of temporary accounts removed and/or disabled system-generated list of emergency accounts removed and/or disabled system audit records system security plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security with information security responsibilities system developers Test Automated mechanisms for implementing account management functions
AC-02(03) [M] Disable Accounts – Assessment Procedure	Assessment Objective Determine if: AC-02(03)(a) accounts are disabled within [Assignment: time period] when the accounts have expired; AC-02(03)(b) accounts are disabled within [Assignment: time period] when the accounts are no longer associated with a user or individual; AC-02(03)(c) accounts are disabled within [Assignment: time period] when the accounts are in violation of organizational policy; AC-02(03)(d) accounts are disabled within [Assignment: time period] when the accounts have been inactive for [Assignment: time period]. Assessment Methods Examine Access control policy procedures for addressing account management system security plan system design documentation system configuration settings and associated documentation system-generated list of accounts removed system-generated list of emergency accounts disabled system audit records system security plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms for implementing account management functions
AC-02(04) [M] Automated Audit Actions – Assessment Procedure	Assessment Objective Determine if: AC-02(04)[01] account creation is automatically audited; AC-02(04)[02] account modification is automatically audited; AC-02(04)[03] account enabling is automatically audited; AC-02(04)[04] account disabling is automatically audited; AC-02(04)[05] account removal actions are automatically audited. Assessment Methods Examine Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation notifications/alerts of account creation, modification, enabling, disabling, and removal actions system audit records system security plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities Test Automated mechanisms implementing account management functions
AC-02(05) [M] Inactivity Logout – Assessment Procedure	Assessment Objective Determine if: AC-02(05) users are required to log out when [Assignment: time period of expected inactivity or description of when to log out]. Assessment Methods Examine Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation security violation reports system audit records system security plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities users that must comply with inactivity logout policy
AC-02(13) [M] Disable Accounts for High-risk Individuals – Assessment Procedure	Assessment Objective Determine if: AC-02(13) accounts of individuals are disabled within [Assignment: time period] of discovery of [Assignment: significant risks]. Assessment Methods Examine Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation system-generated list of disabled accounts list of user activities posing significant organizational risk system audit records system security plan other relevant documents or records Interview Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities Test Mechanisms implementing account management functions
AC-03 [M] Access Enforcement – Assessment Procedure	Assessment Objective Determine if: AC-03 approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies. Assessment Methods Examine Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of approved authorizations (user privileges) system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security and privacy responsibilities system developers Test Mechanisms implementing access control policy
AC-04 [M] Information Flow Enforcement – Assessment Procedure	Assessment Objective Determine if: AC-04 approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [Assignment: information flow control policies]. Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement security architecture documentation privacy architecture documentation system design documentation system configuration settings and associated documentation system baseline configuration list of information flow authorizations system audit records system security plan privacy plan other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy architecture development responsibilities organizational personnel with information security and privacy responsibilities system developers Test Mechanisms implementing information flow enforcement policy
AC-05 [M] Separation of Duties – Assessment Procedure	Assessment Objective Determine if: AC-05a. [Assignment: duties of individuals] are identified and documented; AC-05b. system access authorizations to support separation of duties are defined. Assessment Methods Examine Access control policy procedures addressing divisions of responsibility and separation of duties system configuration settings and associated documentation list of divisions of responsibility and separation of duties system access authorizations system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining appropriate divisions of responsibility and separation of duties organizational personnel with information security responsibilities system/network administrators Test Mechanisms implementing separation of duties policy
AC-06 [M] Least Privilege – Assessment Procedure	Assessment Objective Determine if: AC-06 the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. Assessment Methods Examine Access control policy procedures addressing least privilege list of assigned access authorizations (user privileges) system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system/network administrators Test Mechanisms implementing least privilege functions
AC-06(01) [M] Authorize Access to Security Functions – Assessment Procedure	Assessment Objective Determine if: AC-06(01)(a) AC-06(01)(a)[01] access is authorized for [Assignment: individuals and roles] to [Assignment: security functions (deployed in hardware)]; AC-06(01)(a)[02] access is authorized for [Assignment: individuals and roles] to [Assignment: security functions (deployed in software)]; AC-06(01)(a)[03] access is authorized for [Assignment: individuals and roles] to [Assignment: security functions (deployed in firmware)]; AC-06(01)(b) access is authorized for [Assignment: individuals and roles] to [Assignment: security-relevant information]. Assessment Methods Examine Access control policy procedures addressing least privilege list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system/network administrators Test Mechanisms implementing least privilege functions
AC-06(02) [M] Non-privileged Access for Nonsecurity Functions – Assessment Procedure	Assessment Objective Determine if: AC-06(02) users of system accounts (or roles) with access to [Assignment: security functions or security-relevant information] are required to use non-privileged accounts or roles when accessing non-security functions. Assessment Methods Examine Access control policy procedures addressing least privilege list of system-generated security functions or security-relevant information assigned to system accounts or roles system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system/network administrators Test Mechanisms implementing least privilege functions
AC-06(05) [M] Privileged Accounts – Assessment Procedure	Assessment Objective Determine if: AC-06(05) privileged accounts on the system are restricted to [Assignment: personnel or roles]. Assessment Methods Examine Access control policy procedures addressing least privilege list of system-generated privileged accounts list of system administration personnel system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system/network administrators Test Mechanisms implementing least privilege functions
AC-06(07) [M] Review of User Privileges – Assessment Procedure	Assessment Objective Determine if: AC-06(07)(a) privileges assigned to [Assignment: roles and classes] are reviewed [Assignment: frequency] to validate the need for such privileges; AC-06(07)(b) privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs. Assessment Methods Examine Access control policy procedures addressing least privilege list of system-generated roles or classes of users and assigned privileges system design documentation system configuration settings and associated documentation validation reviews of privileges assigned to roles or classes or users records of privilege removals or reassignments for roles or classes of users system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system/network administrators Test Mechanisms implementing review of user privileges
AC-06(09) [M] Log Use of Privileged Functions – Assessment Procedure	Assessment Objective Determine if: AC-06(09) the execution of privileged functions is logged. Assessment Methods Examine Access control policy procedures addressing least privilege system design documentation system configuration settings and associated documentation list of privileged functions to be audited list of audited events system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms auditing the execution of least privilege functions
AC-06(10) [M] Prohibit Non-privileged Users from Executing Privileged Functions – Assessment Procedure	Assessment Objective Determine if: AC-06(10) non-privileged users are prevented from executing privileged functions. Assessment Methods Examine Access control policy procedures addressing least privilege system design documentation system configuration settings and associated documentation list of privileged functions and associated user account assignments system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks organizational personnel with information security responsibilities system developers Test Mechanisms implementing least privilege functions for non-privileged users
AC-07 [M] Unsuccessful Logon Attempts – Assessment Procedure	Assessment Objective Determine if: AC-07a. a limit of [Assignment: number] consecutive invalid logon attempts by a user during [Assignment: time period] is enforced; AC-07b. automatically [Selection (one or more): lock the account or node for [Assignment: time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: delay algorithm] ; notify system administrator; take other [Assignment: action] ] when the maximum number of unsuccessful attempts is exceeded. Assessment Methods Examine Access control policy procedures addressing unsuccessful logon attempts system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities system developers system/network administrators Test Mechanisms implementing access control policy for unsuccessful logon attempts
AC-08 [M] System Use Notification – Assessment Procedure	Assessment Objective Determine if: AC-08a. [Assignment: system use notification] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; AC-08a.01 the system use notification states that users are accessing a U.S. Government system; AC-08a.02 the system use notification states that system usage may be monitored, recorded, and subject to audit; AC-08a.03 the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and AC-08a.04 the system use notification states that use of the system indicates consent to monitoring and recording; AC-08b. the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; AC-08c. AC-08c.01 for publicly accessible systems, system use information [Assignment: conditions] is displayed before granting further access to the publicly accessible system; AC-08c.02 for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed; AC-08c.03 for publicly accessible systems, a description of the authorized uses of the system is included. Assessment Methods Examine Access control policy privacy and security policies, procedures addressing system use notification documented approval of system use notification messages or banners system audit records user acknowledgements of notification message or banner system design documentation system configuration settings and associated documentation system use notification messages system security plan privacy plan privacy impact assessment privacy assessment report other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy responsibilities legal counsel system developers Test Mechanisms implementing system use notification
AC-11 [M] Device Lock – Assessment Procedure	Assessment Objective Determine if: AC-11a. further access to the system is prevented by [Selection (one or more): initiating a device lock after [Assignment: time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended]; AC-11b. device lock is retained until the user re-establishes access using established identification and authentication procedures. Assessment Methods Examine Access control policy procedures addressing session lock procedures addressing identification and authentication system design documentation system configuration settings and associated documentation security plan system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing access control policy for session lock
AC-11(01) [M] Pattern-hiding Displays – Assessment Procedure	Assessment Objective Determine if: AC-11(01) information previously visible on the display is concealed, via device lock, with a publicly viewable image. Assessment Methods Examine Access control policy procedures addressing session lock display screen with session lock activated system design documentation system configuration settings and associated documentation system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test System session lock mechanisms
AC-12 [M] Session Termination – Assessment Procedure	Assessment Objective Determine if: AC-12 a user session is automatically terminated after [Assignment: conditions or trigger events]. Assessment Methods Examine Access control policy procedures addressing session termination system design documentation system configuration settings and associated documentation list of conditions or trigger events requiring session disconnect system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Automated mechanisms implementing user session termination
AC-14 [M] Permitted Actions Without Identification or Authentication – Assessment Procedure	Assessment Objective Determine if: AC-14a. [Assignment: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified; AC-14b. AC-14b.[01] user actions not requiring identification or authentication are documented in the security plan for the system; AC-14b.[02] a rationale for user actions not requiring identification or authentication is provided in the security plan for the system. Assessment Methods Examine Access control policy procedures addressing permitted actions without identification or authentication system configuration settings and associated documentation security plan list of user actions that can be performed without identification or authentication system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities
AC-17 [M] Remote Access – Assessment Procedure	Assessment Objective Determine if: AC-17a. AC-17a.[01] usage restrictions are established and documented for each type of remote access allowed; AC-17a.[02] configuration/connection requirements are established and documented for each type of remote access allowed; AC-17a.[03] implementation guidance is established and documented for each type of remote access allowed; AC-17b. each type of remote access to the system is authorized prior to allowing such connections. Assessment Methods Examine Access control policy procedures addressing remote access implementation and usage (including restrictions) configuration management plan system configuration settings and associated documentation remote access authorizations system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for managing remote access connections system/network administrators organizational personnel with information security responsibilities Test Remote access management capability for the system
AC-17(01) [M] Monitoring and Control – Assessment Procedure	Assessment Objective Determine if: AC-17(01)[01] automated mechanisms are employed to monitor remote access methods; AC-17(01)[02] automated mechanisms are employed to control remote access methods. Assessment Methods Examine Access control policy procedures addressing remote access to the system system design documentation system configuration settings and associated documentation system audit records system monitoring records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Automated mechanisms monitoring and controlling remote access methods
AC-17(02) [M] Protection of Confidentiality and Integrity Using Encryption – Assessment Procedure	Assessment Objective Determine if: AC-17(02) cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions. Assessment Methods Examine Access control policy procedures addressing remote access to the system system design documentation system configuration settings and associated documentation cryptographic mechanisms and associated configuration documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Cryptographic mechanisms protecting confidentiality and integrity of remote access sessions
AC-17(03) [M] Managed Access Control Points – Assessment Procedure	Assessment Objective Determine if: AC-17(03) remote accesses are routed through authorized and managed network access control points. Assessment Methods Examine Access control policy procedures addressing remote access to the system system design documentation list of all managed network access control points system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities Test Mechanisms routing all remote accesses through managed network access control points
AC-17(04) [M] Privileged Commands and Access – Assessment Procedure	Assessment Objective Determine if: AC-17(04)(a) AC-17(04)(a)[01] the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence; AC-17(04)(a)[02] access to security-relevant information via remote access is authorized only in a format that provides assessable evidence; AC-17(04)(a)[03] the execution of privileged commands via remote access is authorized only for the following needs: [Assignment: needs requiring remote access]; AC-17(04)(a)[04] access to security-relevant information via remote access is authorized only for the following needs: [Assignment: needs requiring remote access]; AC-17(04)(b) the rationale for remote access is documented in the security plan for the system. Assessment Methods Examine Access control policy procedures addressing remote access to the system system configuration settings and associated documentation security plan system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities Test Mechanisms implementing remote access management
AC-18 [M] Wireless Access – Assessment Procedure	Assessment Objective Determine if: AC-18a. AC-18a.[01] configuration requirements are established for each type of wireless access; AC-18a.[02] connection requirements are established for each type of wireless access; AC-18a.[03] implementation guidance is established for each type of wireless access; AC-18b. each type of wireless access to the system is authorized prior to allowing such connections. Assessment Methods Examine Access control policy procedures addressing wireless access implementation and usage (including restrictions) configuration management plan system design documentation system configuration settings and associated documentation wireless access authorizations system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for managing wireless access connections organizational personnel with information security responsibilities Test Wireless access management capability for the system
AC-18(01) [M] Authentication and Encryption – Assessment Procedure	Assessment Objective Determine if: AC-18(01)[01] wireless access to the system is protected using authentication of [Selection (one or more): users; devices]; AC-18(01)[02] wireless access to the system is protected using encryption. Assessment Methods Examine Access control policy procedures addressing wireless implementation and usage (including restrictions) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing wireless access protections to the system
AC-18(03) [M] Disable Wireless Networking – Assessment Procedure	Assessment Objective Determine if: AC-18(03) when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment. Assessment Methods Examine Access control policy procedures addressing wireless implementation and usage (including restrictions) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities Test Mechanisms managing the disabling of wireless networking capabilities internally embedded within system components
AC-19 [M] Access Control for Mobile Devices – Assessment Procedure	Assessment Objective Determine if: AC-19a. AC-19a.[01] configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area; AC-19a.[02] connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area; AC-19a.[03] implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area; AC-19b. the connection of mobile devices to organizational systems is authorized. Assessment Methods Examine Access control policy procedures addressing access control for mobile device usage (including restrictions) configuration management plan system design documentation system configuration settings and associated documentation authorizations for mobile device connections to organizational systems system audit records system security plan other relevant documents or records Interview Organizational personnel using mobile devices to access organizational systems system/network administrators organizational personnel with information security responsibilities Test Access control capability for mobile device connections to organizational systems configurations of mobile devices
AC-19(05) [M] Full Device or Container-based Encryption – Assessment Procedure	Assessment Objective Determine if: AC-19(05) [Selection: full-device encryption; container-based encryption] is employed to protect the confidentiality and integrity of information on [Assignment: mobile devices]. Assessment Methods Examine Access control policy procedures addressing access control for mobile devices system design documentation system configuration settings and associated documentation encryption mechanisms and associated configuration documentation system audit records system security plan other relevant documents or records Interview Organizational personnel with access control responsibilities for mobile devices system/network administrators organizational personnel with information security responsibilities Test Encryption mechanisms protecting confidentiality and integrity of information on mobile devices
AC-20 [M] Use of External Systems – Assessment Procedure	Assessment Objective Determine if: AC-20a. AC-20a.01 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable); AC-20a.02 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable); AC-20b. the use of [Assignment: prohibited types of external systems] is prohibited (if applicable). Assessment Methods Examine Access control policy procedures addressing the use of external systems external systems terms and conditions list of types of applications accessible from external systems maximum security categorization for information processed, stored, or transmitted on external systems system configuration settings and associated documentation system security plan other relevant documents or records Interview Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems system/network administrators organizational personnel with information security responsibilities Test Mechanisms implementing terms and conditions on the use of external systems
AC-20(01) [M] Limits on Authorized Use – Assessment Procedure	Assessment Objective Determine if: AC-20(01)(a) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans (if applicable); AC-20(01)(b) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable). Assessment Methods Examine Access control policy procedures addressing the use of external systems system connection or processing agreements account management documents system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities Test Mechanisms implementing limits on use of external systems
AC-20(02) [M] Portable Storage Devices — Restricted Use – Assessment Procedure	Assessment Objective Determine if: AC-20(02) the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [Assignment: restrictions]. Assessment Methods Examine Access control policy procedures addressing the use of external systems system configuration settings and associated documentation system connection or processing agreements account management documents system security plan other relevant documents or records Interview Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems system/network administrators organizational personnel with information security responsibilities Test Mechanisms implementing restrictions on the use of portable storage devices
AC-21 [M] Information Sharing – Assessment Procedure	Assessment Objective Determine if: AC-21a. authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: information-sharing circumstances]; AC-21b. [Assignment: automated mechanisms] are employed to assist users in making information-sharing and collaboration decisions. Assessment Methods Examine Access control policy procedures addressing user-based collaboration and information sharing (including restrictions) system design documentation system configuration settings and associated documentation list of users authorized to make information-sharing/collaboration decisions list of information-sharing circumstances requiring user discretion non-disclosure agreements acquisitions/contractual agreements system security plan privacy plan privacy impact assessment security and privacy risk assessments other relevant documents or records Interview Organizational personnel responsible for information-sharing/collaboration decisions organizational personnel with responsibility for acquisitions/contractual agreements system/network administrators organizational personnel with information security and privacy responsibilities Test Automated mechanisms or manual process implementing access authorizations supporting information-sharing/user collaboration decisions
AC-22 [M] Publicly Accessible Content – Assessment Procedure	Assessment Objective Determine if: AC-22a. designated individuals are authorized to make information publicly accessible; AC-22b. authorized individuals are trained to ensure that publicly accessible information does not contain non-public information; AC-22c. the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included; AC-22d. AC-22d.[01] the content on the publicly accessible system is reviewed for non-public information [Assignment: frequency]; AC-22d.[02] non-public information is removed from the publicly accessible system, if discovered. Assessment Methods Examine Access control policy procedures addressing publicly accessible content list of users authorized to post publicly accessible content on organizational systems training materials and/or records records of publicly accessible information reviews records of response to non-public information on public websites system audit logs security awareness training records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for managing publicly accessible information posted on organizational systems organizational personnel with information security responsibilities Test Mechanisms implementing management of publicly accessible content
AT-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: AT-01a. AT-01a.[01] an awareness and training policy is developed and documented; AT-01a.[02] the awareness and training policy is disseminated to [Assignment: personnel or roles]; AT-01a.[03] awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented; AT-01a.[04] the awareness and training procedures are disseminated to [Assignment: personnel or roles]. AT-01a.01 AT-01a.01(a) AT-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses purpose; AT-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses scope; AT-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses roles; AT-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses responsibilities; AT-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses management commitment; AT-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses coordination among organizational entities; AT-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses compliance; and AT-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and AT-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures; AT-01c. AT-01c.01 AT-01c.01[01] the current awareness and training policy is reviewed and updated [Assignment: frequency]; AT-01c.01[02] the current awareness and training policy is reviewed and updated following [Assignment: events]; AT-01c.02 AT-01c.02[01] the current awareness and training procedures are reviewed and updated [Assignment: frequency]; AT-01c.02[02] the current awareness and training procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System security plan privacy plan awareness and training policy and procedures other relevant documents or records Interview Organizational personnel with awareness and training responsibilities organizational personnel with information security and privacy responsibilities
AT-02 [M] Literacy Training and Awareness – Assessment Procedure	Assessment Objective Determine if: AT-02a. AT-02a.01 AT-02a.01[01] security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users; AT-02a.01[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users; AT-02a.01[03] security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter; AT-02a.01[04] privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter; AT-02a.02 AT-02a.02[01] security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events]; AT-02a.02[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events]; AT-02b. [Assignment: awareness techniques] are employed to increase the security and privacy awareness of system users; AT-02c. AT-02c.[01] literacy training and awareness content is updated [Assignment: frequency]; AT-02c.[02] literacy training and awareness content is updated following [Assignment: events]; AT-02d. lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques. Assessment Methods Examine System security plan privacy plan literacy training and awareness policy procedures addressing literacy training and awareness implementation appropriate codes of federal regulations security and privacy literacy training curriculum security and privacy literacy training materials training records other relevant documents or records Interview Organizational personnel with responsibilities for literacy training and awareness organizational personnel with information security and privacy responsibilities organizational personnel comprising the general system user community Test Mechanisms managing information security and privacy literacy training
AT-02(02) [M] Insider Threat – Assessment Procedure	Assessment Objective Determine if: AT-02(02)[01] literacy training on recognizing potential indicators of insider threat is provided; AT-02(02)[02] literacy training on reporting potential indicators of insider threat is provided. Assessment Methods Examine System security plan privacy plan literacy training and awareness policy procedures addressing literacy training and awareness implementation literacy training and awareness curriculum literacy training and awareness materials other relevant documents or records Interview Organizational personnel who receive literacy training and awareness organizational personnel with responsibilities for literacy training and awareness organizational personnel with information security and privacy responsibilities
AT-02(03) [M] Social Engineering and Mining – Assessment Procedure	Assessment Objective Determine if: AT-02(03)[01] literacy training on recognizing potential and actual instances of social engineering is provided; AT-02(03)[02] literacy training on reporting potential and actual instances of social engineering is provided; AT-02(03)[03] literacy training on recognizing potential and actual instances of social mining is provided; AT-02(03)[04] literacy training on reporting potential and actual instances of social mining is provided. Assessment Methods Examine System security plan privacy plan literacy training and awareness policy procedures addressing literacy training and awareness implementation literacy training and awareness curriculum literacy training and awareness materials other relevant documents or records Interview Organizational personnel who receive literacy training and awareness organizational personnel with responsibilities for literacy training and awareness organizational personnel with information security and privacy responsibilities
AT-03 [M] Role-based Training – Assessment Procedure	Assessment Objective Determine if: AT-03a. AT-03a.01 AT-03a.01[01] role-based security training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties; AT-03a.01[02] role-based privacy training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties; AT-03a.01[03] role-based security training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter; AT-03a.01[04] role-based privacy training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter; AT-03a.02 AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes; AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes; AT-03b. AT-03b.[01] role-based training content is updated [Assignment: frequency]; AT-03b.[02] role-based training content is updated following [Assignment: events]; AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training. Assessment Methods Examine System security plan privacy plan security and privacy awareness and training policy procedures addressing security and privacy training implementation codes of federal regulations security and privacy training curriculum security and privacy training materials training records other relevant documents or records Interview Organizational personnel with responsibilities for role-based security and privacy training organizational personnel with assigned system security and privacy roles and responsibilities Test Mechanisms managing role-based security and privacy training
AT-04 [M] Training Records – Assessment Procedure	Assessment Objective Determine if: AT-04a. AT-04a.[01] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented; AT-04a.[02] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored; AT-04b. individual training records are retained for [Assignment: time period]. Assessment Methods Examine Security and privacy awareness and training policy procedures addressing security and privacy training records security and privacy awareness and training records system security plan privacy plan other relevant documents or records Interview Organizational personnel with information security and privacy training record retention responsibilities Test Mechanisms supporting the management of security and privacy training records
AU-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: AU-01a. AU-01a.[01] an audit and accountability policy is developed and documented; AU-01a.[02] the audit and accountability policy is disseminated to [Assignment: personnel or roles]; AU-01a.[03] audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented; AU-01a.[04] the audit and accountability procedures are disseminated to [Assignment: personnel or roles]; AU-01a.01 AU-01a.01(a) AU-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose; AU-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope; AU-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles; AU-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities; AU-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment; AU-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities; AU-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance; AU-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; AU-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; AU-01c. AU-01c.01 AU-01c.01[01] the current audit and accountability policy is reviewed and updated [Assignment: frequency]; AU-01c.01[02] the current audit and accountability policy is reviewed and updated following [Assignment: events]; AU-01c.02 AU-01c.02[01] the current audit and accountability procedures are reviewed and updated [Assignment: frequency]; AU-01c.02[02] the current audit and accountability procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Audit and accountability policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities
AU-02 [M] Event Logging – Assessment Procedure	Assessment Objective Determine if: AU-02a. [Assignment: event types] that the system is capable of logging are identified in support of the audit logging function; AU-02b. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; AU-02c. AU-02c.[01] [Assignment: event types (subset of AU-02_ODP[01])] are specified for logging within the system; AU-02c.[02] the specified event types are logged within the system [Assignment: frequency or situation]; AU-02d. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; AU-02e. the event types selected for logging are reviewed and updated [Assignment: frequency]. Assessment Methods Examine Audit and accountability policy procedures addressing auditable events system security plan privacy plan system design documentation system configuration settings and associated documentation system audit records system auditable events other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms implementing system auditing
AU-03 [M] Content of Audit Records – Assessment Procedure	Assessment Objective Determine if: AU-03a. audit records contain information that establishes what type of event occurred; AU-03b. audit records contain information that establishes when the event occurred; AU-03c. audit records contain information that establishes where the event occurred; AU-03d. audit records contain information that establishes the source of the event; AU-03e. audit records contain information that establishes the outcome of the event; AU-03f. audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing content of audit records system design documentation system configuration settings and associated documentation list of organization-defined auditable events system audit records system incident reports other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms implementing system auditing of auditable events
AU-03(01) [M] Additional Audit Information – Assessment Procedure	Assessment Objective Determine if: AU-03(01) generated audit records contain the following [Assignment: additional information]. Assessment Methods Examine Audit and accountability policy procedures addressing content of audit records system security plan privacy plan system design documentation system configuration settings and associated documentation list of organization-defined auditable events system audit records other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test system audit capability
AU-04 [M] Audit Log Storage Capacity – Assessment Procedure	Assessment Objective Determine if: AU-04 audit log storage capacity is allocated to accommodate [Assignment: audit log retention requirements]. Assessment Methods Examine Audit and accountability policy procedures addressing audit storage capacity system security plan privacy plan system design documentation system configuration settings and associated documentation audit record storage requirements audit record storage capability for system components system audit records other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Audit record storage capacity and related configuration settings
AU-05 [M] Response to Audit Logging Process Failures – Assessment Procedure	Assessment Objective Determine if: AU-05a. [Assignment: personnel or roles] are alerted in the event of an audit logging process failure within [Assignment: time period]; AU-05b. [Assignment: additional actions] are taken in the event of an audit logging process failure. Assessment Methods Examine Audit and accountability policy procedures addressing response to audit processing failures system design documentation system security plan privacy plan system configuration settings and associated documentation list of personnel to be notified in case of an audit processing failure system audit records other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing system response to audit processing failures
AU-06 [M] Audit Record Review, Analysis, and Reporting – Assessment Procedure	Assessment Objective Determine if: AU-06a. system audit records are reviewed and analyzed [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; AU-06b. findings are reported to [Assignment: personnel or roles]; AU-06c. the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing audit review, analysis, and reporting reports of audit findings records of actions taken in response to reviews/analyses of audit records other relevant documents or records Interview Organizational personnel with audit review, analysis, and reporting responsibilities organizational personnel with information security and privacy responsibilities
AU-06(01) [M] Automated Process Integration – Assessment Procedure	Assessment Objective Determine if: AU-06(01) audit record review, analysis, and reporting processes are integrated using [Assignment: automated mechanisms]. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing audit review, analysis, and reporting procedures addressing investigation and response to suspicious activities system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with audit review, analysis, and reporting responsibilities organizational personnel with information security and privacy responsibilities Test Automated mechanisms integrating audit review, analysis, and reporting processes
AU-06(03) [M] Correlate Audit Record Repositories – Assessment Procedure	Assessment Objective Determine if: AU-06(03) audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing audit review, analysis, and reporting system design documentation system configuration settings and associated documentation system audit records across different repositories other relevant documents or records Interview Organizational personnel with audit review, analysis, and reporting responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms supporting the analysis and correlation of audit records
AU-07 [M] Audit Record Reduction and Report Generation – Assessment Procedure	Assessment Objective Determine if: AU-07a. AU-07a.[01] an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; AU-07a.[02] an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; AU-07b. AU-07b.[01] an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records; AU-07b.[02] an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing audit reduction and report generation system design documentation system configuration settings and associated documentation audit reduction, review, analysis, and reporting tools system audit records other relevant documents or records Interview Organizational personnel with audit reduction and report generation responsibilities organizational personnel with information security and privacy responsibilities Test Audit reduction and report generation capability
AU-07(01) [M] Automatic Processing – Assessment Procedure	Assessment Objective Determine if: AU-07(01)[01] the capability to process, sort, and search audit records for events of interest based on [Assignment: fields within audit records] are provided; AU-07(01)[02] the capability to process, sort, and search audit records for events of interest based on [Assignment: fields within audit records] are implemented. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing audit reduction and report generation system design documentation system configuration settings and associated documentation audit reduction, review, analysis, and reporting tools audit record criteria (fields) establishing events of interest system audit records other relevant documents or records Interview Organizational personnel with audit reduction and report generation responsibilities organizational personnel with information security and privacy responsibilities system developers Test Audit reduction and report generation capability
AU-08 [M] Time Stamps – Assessment Procedure	Assessment Objective Determine if: AU-08a. internal system clocks are used to generate timestamps for audit records; AU-08b. timestamps are recorded for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp. Assessment Methods Examine Audit and accountability policy system security plan privacy plan procedures addressing timestamp generation system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing timestamp generation
AU-09 [M] Protection of Audit Information – Assessment Procedure	Assessment Objective Determine if: AU-09a. audit information and audit logging tools are protected from unauthorized access, modification, and deletion; AU-09b. [Assignment: personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information. Assessment Methods Examine Audit and accountability policy system security plan privacy plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system audit records audit tools other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing audit information protection
AU-09(04) [M] Access by Subset of Privileged Users – Assessment Procedure	Assessment Objective Determine if: AU-09(04) access to management of audit logging functionality is authorized only to [Assignment: subset of privileged users or roles]. Assessment Methods Examine Audit and accountability policy system security plan privacy plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system-generated list of privileged users with access to management of audit functionality access authorizations access control list system audit records other relevant documents or records Interview Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms managing access to audit functionality
AU-11 [M] Audit Record Retention – Assessment Procedure	Assessment Objective Determine if: AU-11 audit records are retained for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. Assessment Methods Examine Audit and accountability policy system security plan privacy plan audit record retention policy and procedures security plan organization-defined retention period for audit records audit record archives audit logs audit records other relevant documents or records Interview Organizational personnel with audit record retention responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
AU-12 [M] Audit Record Generation – Assessment Procedure	Assessment Objective Determine if: AU-12a. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignment: system components]; AU-12b. [Assignment: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system; AU-12c. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated. Assessment Methods Examine Audit and accountability policy procedures addressing audit record generation system security plan privacy plan system design documentation system configuration settings and associated documentation list of auditable events system audit records other relevant documents or records Interview Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Mechanisms implementing audit record generation capability
CA-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: CA-01a. CA-01a.[01] an assessment, authorization, and monitoring policy is developed and documented; CA-01a.[02] the assessment, authorization, and monitoring policy is disseminated to [Assignment: personnel or roles]; CA-01a.[03] assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented; CA-01a.[04] the assessment, authorization, and monitoring procedures are disseminated to [Assignment: personnel or roles]; CA-01a.01 CA-01a.01(a) CA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses purpose; CA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses scope; CA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses roles; CA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses responsibilities; CA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses management commitment; CA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses coordination among organizational entities; CA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses compliance; CA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; CA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; CA-01c. CA-01c.01 CA-01c.01[01] the current assessment, authorization, and monitoring policy is reviewed and updated [Assignment: frequency]; CA-01c.01[02] the current assessment, authorization, and monitoring policy is reviewed and updated following [Assignment: events]; CA-01c.02 CA-01c.02[01] the current assessment, authorization, and monitoring procedures are reviewed and updated [Assignment: frequency]; CA-01c.02[02] the current assessment, authorization, and monitoring procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Assessment, authorization, and monitoring policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with assessment, authorization, and monitoring policy responsibilities organizational personnel with information security and privacy responsibilities
CA-02 [M] Control Assessments – Assessment Procedure	Assessment Objective Determine if: CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted; CA-02b. CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment; CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness; CA-02b.03 CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment; CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team; CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities; CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; CA-02d. CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements; CA-02e. a control assessment report is produced that documents the results of the assessment; CA-02f. the results of the control assessment are provided to [Assignment: individuals or roles]. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing assessment planning procedures addressing control assessments control assessment plan control assessment report system security plan privacy plan other relevant documents or records Interview Organizational personnel with control assessment responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting
CA-02(01) [M] Independent Assessors – Assessment Procedure	Assessment Objective Determine if: CA-02(01) independent assessors or assessment teams are employed to conduct control assessments. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing control assessments previous control assessment plan previous control assessment report plan of action and milestones existing authorization statement system security plan privacy plan other relevant documents or records Interview Organizational personnel with security assessment responsibilities organizational personnel with information security and privacy responsibilities
CA-03 [M] Information Exchange – Assessment Procedure	Assessment Objective Determine if: CA-03a. the exchange of information between the system and other systems is approved and managed using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: type of agreement] ]; CA-03b. CA-03b.[01] the interface characteristics are documented as part of each exchange agreement; CA-03b.[02] security requirements are documented as part of each exchange agreement; CA-03b.[03] privacy requirements are documented as part of each exchange agreement; CA-03b.[04] controls are documented as part of each exchange agreement; CA-03b.[05] responsibilities for each system are documented as part of each exchange agreement; CA-03b.[06] the impact level of the information communicated is documented as part of each exchange agreement; CA-03c. agreements are reviewed and updated [Assignment: frequency]. Assessment Methods Examine Access control policy procedures addressing system connections system and communications protection policy system interconnection security agreements information exchange security agreements memoranda of understanding or agreements service level agreements non-disclosure agreements system design documentation enterprise architecture system architecture system configuration settings and associated documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements organizational personnel with information security and privacy responsibilities personnel managing the system(s) to which the interconnection security agreement applies
CA-05 [M] Plan of Action and Milestones – Assessment Procedure	Assessment Objective Determine if: CA-05a. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; CA-05b. existing plan of action and milestones are updated [Assignment: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing plan of action and milestones control assessment plan control assessment report control assessment evidence plan of action and milestones system security plan privacy plan other relevant documents or records Interview Organizational personnel with plan of action and milestones development and implementation responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms for developing, implementing, and maintaining plan of action and milestones
CA-06 [M] Authorization – Assessment Procedure	Assessment Objective Determine if: CA-06a. a senior official is assigned as the authorizing official for the system; CA-06b. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems; CA-06c. CA-06c.01 before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system; CA-06c.02 before commencing operations, the authorizing official for the system authorizes the system to operate; CA-06d. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; CA-06e. the authorizations are updated [Assignment: frequency]. Assessment Methods Examine Assessment, authorization, and monitoring policy procedures addressing authorization system security plan, privacy plan, assessment report, plan of action and milestones authorization statement other relevant documents or records Interview Organizational personnel with authorization responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms that facilitate authorizations and updates
CA-07 [M] Continuous Monitoring – Assessment Procedure	Assessment Objective Determine if: CA-07[01] a system-level continuous monitoring strategy is developed; CA-07[02] system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy; CA-07a. system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignment: system-level metrics]; CA-07b. CA-07b.[01] system-level continuous monitoring includes established [Assignment: frequencies] for monitoring; CA-07b.[02] system-level continuous monitoring includes established [Assignment: frequencies] for assessment of control effectiveness; CA-07c. system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy; CA-07d. system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; CA-07e. system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring; CA-07f. system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information; CA-07g. CA-07g.[01] system-level continuous monitoring includes reporting the security status of the system to [Assignment: personnel or roles] [Assignment: frequency]; CA-07g.[02] system-level continuous monitoring includes reporting the privacy status of the system to [Assignment: personnel or roles] [Assignment: frequency]. Assessment Methods Examine Assessment, authorization, and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system controls procedures addressing configuration management control assessment report plan of action and milestones system monitoring records configuration management records impact analyses status reports system security plan privacy plan other relevant documents or records Interview Organizational personnel with continuous monitoring responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Mechanisms implementing continuous monitoring mechanisms supporting response actions to address assessment and monitoring results mechanisms supporting security and privacy status reporting
CA-07(01) [M] Independent Assessment – Assessment Procedure	Assessment Objective Determine if: CA-07(01) independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis. Assessment Methods Examine Assessment, authorization, and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system controls control assessment report plan of action and milestones system monitoring records impact analyses status reports system security plan privacy plan other relevant documents or records Interview Organizational personnel with continuous monitoring responsibilities organizational personnel with information security and privacy responsibilities
CA-07(04) [M] Risk Monitoring – Assessment Procedure	Assessment Objective Determine if: CA-07(04) risk monitoring is an integral part of the continuous monitoring strategy; CA-07(04)(a) effectiveness monitoring is included in risk monitoring; CA-07(04)(b) compliance monitoring is included in risk monitoring; CA-07(04)(c) change monitoring is included in risk monitoring. Assessment Methods Examine Assessment, authorization, and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system controls assessment report plan of action and milestones system monitoring records impact analyses status reports system security plan privacy plan other relevant documents or records Interview Organizational personnel with continuous monitoring responsibilities organizational personnel with information security and privacy responsibilities Test Mechanisms supporting risk monitoring
CA-09 [M] Internal System Connections – Assessment Procedure	Assessment Objective Determine if: CA-09a. internal connections of [Assignment: system components] to the system are authorized; CA-09b. CA-09b.[01] for each internal connection, the interface characteristics are documented; CA-09b.[02] for each internal connection, the security requirements are documented; CA-09b.[03] for each internal connection, the privacy requirements are documented; CA-09b.[04] for each internal connection, the nature of the information communicated is documented; CA-09c. internal system connections are terminated after [Assignment: conditions]; CA-09d. the continued need for each internal connection is reviewed [Assignment: frequency]. Assessment Methods Examine Assessment, authorization, and monitoring policy access control policy procedures addressing system connections system and communications protection policy system design documentation system configuration settings and associated documentation list of components or classes of components authorized as internal system connections assessment report system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections organizational personnel with information security and privacy responsibilities Test Mechanisms supporting internal system connections
CM-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: CM-01a. CM-01a.[01] a configuration management policy is developed and documented; CM-01a.[02] the configuration management policy is disseminated to [Assignment: personnel or roles]; CM-01a.[03] configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented; CM-01a.[04] the configuration management procedures are disseminated to [Assignment: personnel or roles]; CM-01a.01 CM-01a.01(a) CM-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses purpose; CM-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses scope; CM-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses roles; CM-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses responsibilities; CM-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses management commitment; CM-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses coordination among organizational entities; CM-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses compliance; CM-01a.01(b) the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; CM-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures; CM-01c. CM-01c.01 CM-01c.01[01] the current configuration management policy is reviewed and updated [Assignment: frequency]; CM-01c.01[02] the current configuration management policy is reviewed and updated following [Assignment: events]; CM-01c.02 CM-01c.02[01] the current configuration management procedures are reviewed and updated [Assignment: frequency]; CM-01c.02[02] the current configuration management procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Configuration management policy and procedures security and privacy program policies and procedures assessment or audit findings documentation of security incidents or breaches system security plan privacy plan risk management strategy other relevant artifacts, documents, or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities
CM-02 [M] Baseline Configuration – Assessment Procedure	Assessment Objective Determine if: CM-02a. CM-02a.[01] a current baseline configuration of the system is developed and documented; CM-02a.[02] a current baseline configuration of the system is maintained under configuration control; CM-02b. CM-02b.01 the baseline configuration of the system is reviewed and updated [Assignment: frequency]; CM-02b.02 the baseline configuration of the system is reviewed and updated when required due to [Assignment: circumstances]; CM-02b.03 the baseline configuration of the system is reviewed and updated when system components are installed or upgraded. Assessment Methods Examine Configuration management policy procedures addressing the baseline configuration of the system configuration management plan enterprise architecture documentation system design documentation system security plan privacy plan system architecture and configuration documentation system configuration settings and associated documentation system component inventory change control records other relevant documents or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for managing baseline configurations mechanisms supporting configuration control of the baseline configuration
CM-02(02) [M] Automation Support for Accuracy and Currency – Assessment Procedure	Assessment Objective Determine if: CM-02(02)[01] the currency of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]; CM-02(02)[02] the completeness of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]; CM-02(02)[03] the accuracy of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]; CM-02(02)[04] the availability of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]. Assessment Methods Examine Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system component inventory configuration change control records system security plan other relevant documents or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing baseline configurations automated mechanisms implementing baseline configuration maintenance
CM-02(03) [M] Retention of Previous Configurations – Assessment Procedure	Assessment Objective Determine if: CM-02(03) [Assignment: number] of previous baseline configuration version(s) of the system is/are retained to support rollback. Assessment Methods Examine Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system architecture and configuration documentation system configuration settings and associated documentation copies of previous baseline configuration versions system security plan other relevant documents or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing baseline configurations
CM-02(07) [M] Configure Systems and Components for High-risk Areas – Assessment Procedure	Assessment Objective Determine if: CM-02(07)(a) [Assignment: systems or system components] with [Assignment: configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk; CM-02(07)(b) [Assignment: controls] are applied to the systems or system components when the individuals return from travel. Assessment Methods Examine Configuration management policy configuration management plan procedures addressing the baseline configuration of the system procedures addressing system component installations and upgrades system architecture and configuration documentation system configuration settings and associated documentation system component inventory records of system baseline configuration reviews and updates system component installations/upgrades and associated records change control records system security plan other relevant documents or records Interview Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing baseline configurations
CM-03 [M] Configuration Change Control – Assessment Procedure	Assessment Objective Determine if: CM-03a. the types of changes to the system that are configuration-controlled are determined and documented; CM-03b. CM-03b.[01] proposed configuration-controlled changes to the system are reviewed; CM-03b.[02] proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses; CM-03c. configuration change decisions associated with the system are documented; CM-03d. approved configuration-controlled changes to the system are implemented; CM-03e. records of configuration-controlled changes to the system are retained for [Assignment: time period]; CM-03f. CM-03f.[01] activities associated with configuration-controlled changes to the system are monitored; CM-03f.[02] activities associated with configuration-controlled changes to the system are reviewed; CM-03g. CM-03g.[01] configuration change control activities are coordinated and overseen by [Assignment: configuration change control element]; CM-03g.[02] the configuration control element convenes [Selection (one or more): [Assignment: frequency] ; when [Assignment: configuration change conditions] ]. Assessment Methods Examine Configuration management policy procedures addressing system configuration change control configuration management plan system architecture and configuration documentation change control records system audit records change control audit and review reports agenda/minutes/documentation from configuration change control oversight meetings system security plan privacy plan privacy impact assessments system of records notices other relevant documents or records Interview Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar Test Organizational processes for configuration change control mechanisms that implement configuration change control
CM-03(02) [M] Testing, Validation, and Documentation of Changes – Assessment Procedure	Assessment Objective Determine if: CM-03(02)[01] changes to the system are tested before finalizing the implementation of the changes; CM-03(02)[02] changes to the system are validated before finalizing the implementation of the changes; CM-03(02)[03] changes to the system are documented before finalizing the implementation of the changes. Assessment Methods Examine Configuration management policy configuration management plan procedures addressing system configuration change control system design documentation system architecture and configuration documentation system configuration settings and associated documentation test records validation records change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar Test Organizational processes for configuration change control mechanisms supporting and/or implementing, testing, validating, and documenting system changes
CM-03(04) [M] Security and Privacy Representatives – Assessment Procedure	Assessment Objective Determine if: CM-03(04)[01] [Assignment: security representatives] are required to be members of the [Assignment: configuration change control element]; CM-03(04)[02] [Assignment: privacy representatives] are required to be members of the [Assignment: configuration change control element]. Assessment Methods Examine Configuration management policy procedures addressing system configuration change control configuration management plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities members of change control board or similar Test Organizational processes for configuration change control
CM-04 [M] Impact Analyses – Assessment Procedure	Assessment Objective Determine if: CM-04[01] changes to the system are analyzed to determine potential security impacts prior to change implementation; CM-04[02] changes to the system are analyzed to determine potential privacy impacts prior to change implementation. Assessment Methods Examine Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation, system design documentation analysis tools and associated outputs change control records system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibility for conducting security impact analyses organizational personnel with responsibility for conducting privacy impact analyses organizational personnel with information security and privacy responsibilities system developer system/network administrators members of change control board or similar Test Organizational processes for security impact analyses organizational processes for privacy impact analyses
CM-04(02) [M] Verification of Controls – Assessment Procedure	Assessment Objective Determine if: CM-04(02)[01] the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes; CM-04(02)[02] the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes; CM-04(02)[03] the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes; CM-04(02)[04] the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes; CM-04(02)[05] the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes; CM-04(02)[06] the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes. Assessment Methods Examine Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system privacy risk assessment documentation configuration management plan security and privacy impact analysis documentation privacy impact assessment analysis tools and associated outputs change control records control assessment results system audit records system component inventory system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibility for conducting security and privacy impact analyses organizational personnel with information security and privacy responsibilities system/network administrators security and privacy assessors Test Organizational processes for security and privacy impact analyses mechanisms supporting and/or implementing security and privacy impact analyses of changes
CM-05 [M] Access Restrictions for Change – Assessment Procedure	Assessment Objective Determine if: CM-05[01] physical access restrictions associated with changes to the system are defined and documented; CM-05[02] physical access restrictions associated with changes to the system are approved; CM-05[03] physical access restrictions associated with changes to the system are enforced; CM-05[04] logical access restrictions associated with changes to the system are defined and documented; CM-05[05] logical access restrictions associated with changes to the system are approved; CM-05[06] logical access restrictions associated with changes to the system are enforced. Assessment Methods Examine Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing access restrictions to change mechanisms supporting, implementing, or enforcing access restrictions associated with changes to the system
CM-06 [M] Configuration Settings – Assessment Procedure	Assessment Objective Determine if: CM-06a. configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [Assignment: common secure configurations]; CM-06b. the configuration settings documented in CM-06a are implemented; CM-06c. CM-06c.[01] any deviations from established configuration settings for [Assignment: system components] are identified and documented based on [Assignment: operational requirements]; CM-06c.[02] any deviations from established configuration settings for [Assignment: system components] are approved; CM-06d. CM-06d.[01] changes to the configuration settings are monitored in accordance with organizational policies and procedures; CM-06d.[02] changes to the configuration settings are controlled in accordance with organizational policies and procedures. Assessment Methods Examine Configuration management policy procedures addressing configuration settings for the system configuration management plan system design documentation system configuration settings and associated documentation common secure configuration checklists system component inventory evidence supporting approved deviations from established configuration settings change control records system data processing and retention permissions system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel with security configuration management responsibilities organizational personnel with privacy configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for managing configuration settings mechanisms that implement, monitor, and/or control system configuration settings mechanisms that identify and/or document deviations from established configuration settings
CM-07 [M] Least Functionality – Assessment Procedure	Assessment Objective Determine if: CM-07a. the system is configured to provide only [Assignment: mission-essential capabilities]; CM-07b. CM-07b.[01] the use of [Assignment: functions] is prohibited or restricted; CM-07b.[02] the use of [Assignment: ports] is prohibited or restricted; CM-07b.[03] the use of [Assignment: protocols] is prohibited or restricted; CM-07b.[04] the use of [Assignment: software] is prohibited or restricted; CM-07b.[05] the use of [Assignment: services] is prohibited or restricted. Assessment Methods Examine Configuration management policy procedures addressing least functionality in the system configuration management plan system design documentation system configuration settings and associated documentation system component inventory common secure configuration checklists system security plan other relevant documents or records Interview Organizational personnel with security configuration management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Organizational processes prohibiting or restricting functions, ports, protocols, software, and/or services mechanisms implementing restrictions or prohibition of functions, ports, protocols, software, and/or services
CM-07(01) [M] Periodic Review – Assessment Procedure	Assessment Objective Determine if: CM-07(01)(a) the system is reviewed [Assignment: frequency] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services: CM-07(01)(b) CM-07(01)(b)[01] [Assignment: functions] deemed to be unnecessary and/or non-secure are disabled or removed; CM-07(01)(b)[02] [Assignment: ports] deemed to be unnecessary and/or non-secure are disabled or removed; CM-07(01)(b)[03] [Assignment: protocols] deemed to be unnecessary and/or non-secure are disabled or removed; CM-07(01)(b)[04] [Assignment: software] deemed to be unnecessary and/or non-secure is disabled or removed; CM-07(01)(b)[05] [Assignment: services] deemed to be unnecessary and/or non-secure are disabled or removed. Assessment Methods Examine Configuration management policy procedures addressing least functionality in the system configuration management plan system design documentation system configuration settings and associated documentation common secure configuration checklists documented reviews of functions, ports, protocols, and/or services change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for reviewing functions, ports, protocols, and services on the system organizational personnel with information security responsibilities system/network administrators system developers Test Organizational processes for reviewing or disabling functions, ports, protocols, and services on the system mechanisms implementing review and disabling of functions, ports, protocols, and/or services
CM-07(02) [M] Prevent Program Execution – Assessment Procedure	Assessment Objective Determine if: CM-07(02) program execution is prevented in accordance with [Selection (one or more): [Assignment: policies, rules of behavior, and/or access agreements regarding software program usage and restrictions] ; rules authorizing the terms and conditions of software program usage]. Assessment Methods Examine Configuration management policy procedures addressing least functionality in the system configuration management plan system design documentation system configuration settings and associated documentation system component inventory common secure configuration checklists specifications for preventing software program execution change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities system/network administrators system developers Test Organizational processes preventing program execution on the system organizational processes for software program usage and restrictions mechanisms preventing program execution on the system mechanisms supporting and/or implementing software program usage and restrictions
CM-07(05) [M] Authorized Software — Allow-by-exception – Assessment Procedure	Assessment Objective Determine if: CM-07(05)(a) [Assignment: software programs] are identified; CM-07(05)(b) a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed; CM-07(05)(c) the list of authorized software programs is reviewed and updated [Assignment: frequency]. Assessment Methods Examine Configuration management policy procedures addressing least functionality in the system configuration management plan system design documentation system configuration settings and associated documentation list of software programs authorized to execute on the system system component inventory common secure configuration checklists review and update records associated with list of authorized software programs change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for identifying software authorized to execute on the system organizational personnel with information security responsibilities system/network administrators Test Organizational process for identifying, reviewing, and updating programs authorized to execute on the system organizational process for implementing authorized software policy mechanisms supporting and/or implementing authorized software policy
CM-08 [M] System Component Inventory – Assessment Procedure	Assessment Objective Determine if: CM-08a. CM-08a.01 an inventory of system components that accurately reflects the system is developed and documented; CM-08a.02 an inventory of system components that includes all components within the system is developed and documented; CM-08a.03 an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented; CM-08a.04 an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented; CM-08a.05 an inventory of system components that includes [Assignment: information] is developed and documented; CM-08b. the system component inventory is reviewed and updated [Assignment: frequency]. Assessment Methods Examine Configuration management policy procedures addressing system component inventory configuration management plan system security plan system design documentation system component inventory inventory reviews and update records system security plan other relevant documents or records Interview Organizational personnel with component inventory management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing the system component inventory mechanisms supporting and/or implementing system component inventory
CM-08(01) [M] Updates During Installation and Removal – Assessment Procedure	Assessment Objective Determine if: CM-08(01)[01] the inventory of system components is updated as part of component installations; CM-08(01)[02] the inventory of system components is updated as part of component removals; CM-08(01)[03] the inventory of system components is updated as part of system updates. Assessment Methods Examine Configuration management policy procedures addressing system component inventory configuration management plan system security plan system component inventory inventory reviews and update records change control records component installation records component removal records system security plan other relevant documents or records Interview Organizational personnel with component inventory updating responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for updating the system component inventory mechanisms supporting and/or implementing system component inventory updates
CM-08(03) [M] Automated Unauthorized Component Detection – Assessment Procedure	Assessment Objective Determine if: CM-08(03)(a) CM-08(03)(a)[01] the presence of unauthorized hardware within the system is detected using [Assignment: automated mechanisms] [Assignment: frequency]; CM-08(03)(a)[02] the presence of unauthorized software within the system is detected using [Assignment: automated mechanisms] [Assignment: frequency]; CM-08(03)(a)[03] the presence of unauthorized firmware within the system is detected using [Assignment: automated mechanisms] [Assignment: frequency]; CM-08(03)(b) CM-08(03)(b)[01] [Selection (one or more): disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: personnel or roles] ] are taken when unauthorized hardware is detected; CM-08(03)(b)[02] [Selection (one or more): disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: personnel or roles] ] are taken when unauthorized software is detected; CM-08(03)(b)[03] [Selection (one or more): disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: personnel or roles] ] are taken when unauthorized firmware is detected. Assessment Methods Examine Configuration management policy procedures addressing system component inventory configuration management plan system design documentation system security plan system component inventory change control records alerts/notifications of unauthorized components within the system system monitoring records system maintenance records system audit records system security plan other relevant documents or records Interview Organizational personnel with component inventory management responsibilities organizational personnel with responsibilities for managing the automated mechanisms implementing unauthorized system component detection organizational personnel with information security responsibilities system/network administrators system developers Test Organizational processes for detection of unauthorized system components organizational processes for taking action when unauthorized system components are detected automated mechanisms supporting and/or implementing the detection of unauthorized system components automated mechanisms supporting and/or implementing actions taken when unauthorized system components are detected
CM-09 [M] Configuration Management Plan – Assessment Procedure	Assessment Objective Determine if: CM-09[01] a configuration management plan for the system is developed and documented; CM-09[02] a configuration management plan for the system is implemented; CM-09a. CM-09a.[01] the configuration management plan addresses roles; CM-09a.[02] the configuration management plan addresses responsibilities; CM-09a.[03] the configuration management plan addresses configuration management processes and procedures; CM-09b. CM-09b.[01] the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle; CM-09b.[02] the configuration management plan establishes a process for managing the configuration of the configuration items; CM-09c. CM-09c.[01] the configuration management plan defines the configuration items for the system; CM-09c.[02] the configuration management plan places the configuration items under configuration management; CM-09d. the configuration management plan is reviewed and approved by [Assignment: personnel or roles]; CM-09e. CM-09e.[01] the configuration management plan is protected from unauthorized disclosure; CM-09e.[02] the configuration management plan is protected from unauthorized modification. Assessment Methods Examine Configuration management policy procedures addressing configuration management planning configuration management plan system design documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for developing the configuration management plan organizational personnel with responsibilities for implementing and managing processes defined in the configuration management plan organizational personnel with responsibilities for protecting the configuration management plan organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for developing and documenting the configuration management plan organizational processes for identifying and managing configuration items organizational processes for protecting the configuration management plan mechanisms implementing the configuration management plan mechanisms for managing configuration items mechanisms for protecting the configuration management plan
CM-10 [M] Software Usage Restrictions – Assessment Procedure	Assessment Objective Determine if: CM-10a. software and associated documentation are used in accordance with contract agreements and copyright laws; CM-10b. the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution; CM-10c. the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. Assessment Methods Examine Configuration management policy software usage restrictions software contract agreements and copyright laws site license documentation list of software usage restrictions software license tracking reports configuration management plan system security plan system security plan other relevant documents or records Interview Organizational personnel operating, using, and/or maintaining the system organizational personnel with software license management responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for tracking the use of software protected by quantity licenses organizational processes for controlling/documenting the use of peer-to-peer file sharing technology mechanisms implementing software license tracking mechanisms implementing and controlling the use of peer-to-peer files sharing technology
CM-11 [M] User-installed Software – Assessment Procedure	Assessment Objective Determine if: CM-11a. [Assignment: policies] governing the installation of software by users are established; CM-11b. software installation policies are enforced through [Assignment: methods]; CM-11c. compliance with [Assignment: policies] is monitored [Assignment: frequency]. Assessment Methods Examine Configuration management policy procedures addressing user-installed software configuration management plan system security plan system design documentation system configuration settings and associated documentation list of rules governing user installed software system monitoring records system audit records continuous monitoring strategy system security plan other relevant documents or records Interview Organizational personnel with responsibilities for governing user-installed software organizational personnel operating, using, and/or maintaining the system organizational personnel monitoring compliance with user-installed software policy organizational personnel with information security responsibilities system/network administrators Test Organizational processes governing user-installed software on the system mechanisms enforcing policies and methods for governing the installation of software by users mechanisms monitoring policy compliance
CM-12 [M] Information Location – Assessment Procedure	Assessment Objective Determine if: CM-12a. CM-12a.[01] the location of [Assignment: information] is identified and documented; CM-12a.[02] the specific system components on which [Assignment: information] is processed are identified and documented; CM-12a.[03] the specific system components on which [Assignment: information] is stored are identified and documented; CM-12b. CM-12b.[01] the users who have access to the system and system components where [Assignment: information] is processed are identified and documented; CM-12b.[02] the users who have access to the system and system components where [Assignment: information] is stored are identified and documented; CM-12c. CM-12c.[01] changes to the location (i.e., system or system components) where [Assignment: information] is processed are documented; CM-12c.[02] changes to the location (i.e., system or system components) where [Assignment: information] is stored are documented. Assessment Methods Examine Configuration management policy procedures addressing identification and documentation of information location configuration management plan system design documentation system architecture documentation PII inventory documentation data mapping documentation audit records list of users with system and system component access change control records system component inventory system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for managing information location and user access to information organizational personnel with responsibilities for operating, using, and/or maintaining the system organizational personnel with information security and privacy responsibilities system/network administrators system developers Test Organizational processes governing information location mechanisms enforcing policies and methods for governing information location
CM-12(01) [M] Automated Tools to Support Information Location – Assessment Procedure	Assessment Objective Determine if: CM-12(01) automated tools are used to identify [Assignment: information by information type] on [Assignment: system components] to ensure that controls are in place to protect organizational information and individual privacy. Assessment Methods Examine Configuration management policy procedures addressing identification and documentation of information location configuration management plan system design documentation PII inventory documentation data mapping documentation change control records system component inventory system security plan privacy plan other relevant documents or records Interview Organizational personnel with responsibilities for managing information location organizational personnel with information security responsibilities system/network administrators system developers Test Organizational processes governing information location automated mechanisms enforcing policies and methods for governing information location automated tools used to identify information on system components
CP-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: CP-01a. CP-01a.[01] a contingency planning policy is developed and documented; CP-01a.[02] the contingency planning policy is disseminated to [Assignment: personnel or roles]; CP-01a.[03] contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented; CP-01a.[04] the contingency planning procedures are disseminated to [Assignment: personnel or roles]; CP-01a.01 CP-01a.01(a) CP-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses purpose; CP-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses scope; CP-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses roles; CP-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses responsibilities; CP-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses management commitment; CP-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses coordination among organizational entities; CP-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy addresses compliance; CP-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; CP-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures; CP-01c. CP-01c.01 CP-01c.01[01] the current contingency planning policy is reviewed and updated [Assignment: frequency]; CP-01c.01[02] the current contingency planning policy is reviewed and updated following [Assignment: events]; CP-01c.02 CP-01c.02[01] the current contingency planning procedures are reviewed and updated [Assignment: frequency]; CP-01c.02[02] the current contingency planning procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Contingency planning policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities
CP-02 [M] Contingency Plan – Assessment Procedure	Assessment Objective Determine if: CP-02a. CP-02a.01 a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements; CP-02a.02 CP-02a.02[01] a contingency plan for the system is developed that provides recovery objectives; CP-02a.02[02] a contingency plan for the system is developed that provides restoration priorities; CP-02a.02[03] a contingency plan for the system is developed that provides metrics; CP-02a.03 CP-02a.03[01] a contingency plan for the system is developed that addresses contingency roles; CP-02a.03[02] a contingency plan for the system is developed that addresses contingency responsibilities; CP-02a.03[03] a contingency plan for the system is developed that addresses assigned individuals with contact information; CP-02a.04 a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; CP-02a.05 a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented; CP-02a.06 a contingency plan for the system is developed that addresses the sharing of contingency information; CP-02a.07 CP-02a.07[01] a contingency plan for the system is developed that is reviewed by [Assignment: personnel or roles]; CP-02a.07[02] a contingency plan for the system is developed that is approved by [Assignment: personnel or roles]; CP-02b. CP-02b.[01] copies of the contingency plan are distributed to [Assignment: key contingency personnel]; CP-02b.[02] copies of the contingency plan are distributed to [Assignment: organizational elements]; CP-02c. contingency planning activities are coordinated with incident handling activities; CP-02d. the contingency plan for the system is reviewed [Assignment: frequency]; CP-02e. CP-02e.[01] the contingency plan is updated to address changes to the organization, system, or environment of operation; CP-02e.[02] the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing; CP-02f. CP-02f.[01] contingency plan changes are communicated to [Assignment: key contingency personnel]; CP-02f.[02] contingency plan changes are communicated to [Assignment: organizational elements]; CP-02g. CP-02g.[01] lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing; CP-02g.[02] lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training; CP-02h. CP-02h.[01] the contingency plan is protected from unauthorized disclosure; CP-02h.[02] the contingency plan is protected from unauthorized modification. Assessment Methods Examine Contingency planning policy procedures addressing contingency operations for the system contingency plan evidence of contingency plan reviews and updates system security plan other relevant documents or records Interview Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with incident handling responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities Test Organizational processes for contingency plan development, review, update, and protection mechanisms for developing, reviewing, updating, and/or protecting the contingency plan
CP-02(01) [M] Coordinate with Related Plans – Assessment Procedure	Assessment Objective Determine if: CP-02(01) contingency plan development is coordinated with organizational elements responsible for related plans. Assessment Methods Examine Contingency planning policy procedures addressing contingency operations for the system contingency plan business contingency plans disaster recovery plans continuity of operations plans crisis communications plans critical infrastructure plans cyber incident response plan insider threat implementation plans occupant emergency plans system security plan other relevant documents or records Interview Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with information security responsibilities personnel with responsibility for related plans
CP-02(03) [M] Resume Mission and Business Functions – Assessment Procedure	Assessment Objective Determine if: CP-02(03) the resumption of [Selection: all; essential] mission and business functions are planned for within [Assignment: time period] of contingency plan activation. Assessment Methods Examine Contingency planning policy procedures addressing contingency operations for the system contingency plan business impact assessment system security plan privacy plan other related plans system security plan other relevant documents or records Interview Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with knowledge of requirements for mission and business functions Test Organizational processes for resumption of missions and business functions
CP-02(08) [M] Identify Critical Assets – Assessment Procedure	Assessment Objective Determine if: CP-02(08) critical system assets supporting [Selection: all; essential] mission and business functions are identified. Assessment Methods Examine Contingency planning policy procedures addressing contingency operations for the system contingency plan business impact assessment system security plan other relevant documents or records Interview Organizational personnel with contingency planning and plan implementation responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities
CP-03 [M] Contingency Training – Assessment Procedure	Assessment Objective Determine if: CP-03a. CP-03a.01 contingency training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming a contingency role or responsibility; CP-03a.02 contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes; CP-03a.03 contingency training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter; CP-03b. CP-03b.[01] the contingency plan training content is reviewed and updated [Assignment: frequency]; CP-03b.[02] the contingency plan training content is reviewed and updated following [Assignment: events]. Assessment Methods Examine Contingency planning policy procedures addressing contingency training contingency plan contingency training curriculum contingency training material contingency training records system security plan other relevant documents or records Interview Organizational personnel with contingency planning, plan implementation, and training responsibilities organizational personnel with information security responsibilities Test Organizational processes for contingency training
CP-04 [M] Contingency Plan Testing – Assessment Procedure	Assessment Objective Determine if: CP-04a. CP-04a.[01] the contingency plan for the system is tested [Assignment: frequency]; CP-04a.[02] [Assignment: tests] are used to determine the effectiveness of the plan; CP-04a.[03] [Assignment: tests] are used to determine the readiness to execute the plan; CP-04b. the contingency plan test results are reviewed; CP-04c. corrective actions are initiated, if needed. Assessment Methods Examine Contingency planning policy procedures addressing contingency plan testing contingency plan contingency plan test documentation contingency plan test results system security plan other relevant documents or records Interview Organizational personnel with responsibilities for contingency plan testing, reviewing, or responding to contingency plan tests organizational personnel with information security responsibilities Test Organizational processes for contingency plan testing mechanisms supporting the contingency plan and/or contingency plan testing
CP-04(01) [M] Coordinate with Related Plans – Assessment Procedure	Assessment Objective Determine if: CP-04(01) contingency plan testing is coordinated with organizational elements responsible for related plans. Assessment Methods Examine Contingency planning policy incident response policy procedures addressing contingency plan testing contingency plan testing documentation contingency plan business continuity plans disaster recovery plans continuity of operations plans crisis communications plans critical infrastructure plans cyber incident response plans occupant emergency plans system security plan other relevant documents or records Interview Organizational personnel with contingency plan testing responsibilities personnel with responsibilities for related plans organizational personnel with information security responsibilities
CP-06 [M] Alternate Storage Site – Assessment Procedure	Assessment Objective Determine if: CP-06a. CP-06a.[01] an alternate storage site is established; CP-06a.[02] establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information; CP-06b. the alternate storage site provides controls equivalent to that of the primary site. Assessment Methods Examine Contingency planning policy procedures addressing alternate storage sites contingency plan alternate storage site agreements primary storage site agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan alternate storage site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities Test Organizational processes for storing and retrieving system backup information at the alternate storage site mechanisms supporting and/or implementing the storage and retrieval of system backup information at the alternate storage site
CP-06(01) [M] Separation from Primary Site – Assessment Procedure	Assessment Objective Determine if: CP-06(01) an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats. Assessment Methods Examine Contingency planning policy procedures addressing alternate storage sites contingency plan alternate storage site alternate storage site agreements primary storage site agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan alternate storage site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities
CP-06(03) [M] Accessibility – Assessment Procedure	Assessment Objective Determine if: CP-06(03)[01] potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified; CP-06(03)[02] explicit mitigation actions to address identified accessibility problems are outlined. Assessment Methods Examine Contingency planning policy procedures addressing alternate storage sites contingency plan alternate storage site list of potential accessibility problems to alternate storage site mitigation actions for accessibility problems to alternate storage site organizational risk assessments system security plan other relevant documents or records Interview Organizational personnel with contingency plan alternate storage site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities
CP-07 [M] Alternate Processing Site – Assessment Procedure	Assessment Objective Determine if: CP-07a. an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: system operations] for essential mission and business functions, is established within [Assignment: time period] when the primary processing capabilities are unavailable; CP-07b. CP-07b.[01] the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [Assignment: time period] for transfer; CP-07b.[02] the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [Assignment: time period] for resumption; CP-07c. controls provided at the alternate processing site are equivalent to those at the primary site. Assessment Methods Examine Contingency planning policy procedures addressing alternate processing sites contingency plan alternate processing site agreements primary processing site agreements spare equipment and supplies inventory at alternate processing site equipment and supply contracts service-level agreements system security plan other relevant documents or records Interview Organizational personnel with responsibilities for contingency planning and/or alternate site arrangements organizational personnel with information security responsibilities Test Organizational processes for recovery at the alternate site mechanisms supporting and/or implementing recovery at the alternate processing site
CP-07(01) [M] Separation from Primary Site – Assessment Procedure	Assessment Objective Determine if: CP-07(01) an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified. Assessment Methods Examine Contingency planning policy procedures addressing alternate processing sites contingency plan alternate processing site alternate processing site agreements primary processing site agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan alternate processing site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities
CP-07(02) [M] Accessibility – Assessment Procedure	Assessment Objective Determine if: CP-07(02)[01] potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified; CP-07(02)[02] explicit mitigation actions to address identified accessibility problems are outlined. Assessment Methods Examine Contingency planning policy procedures addressing alternate processing sites contingency plan alternate processing site alternate processing site agreements primary processing site agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan alternate processing site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities
CP-07(03) [M] Priority of Service – Assessment Procedure	Assessment Objective Determine if: CP-07(03) alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed. Assessment Methods Examine Contingency planning policy procedures addressing alternate processing sites contingency plan alternate processing site agreements service-level agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan alternate processing site responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements
CP-08 [M] Telecommunications Services – Assessment Procedure	Assessment Objective Determine if: CP-08 alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: system operations] , are established for essential mission and business functions within [Assignment: time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. Assessment Methods Examine Contingency planning policy procedures addressing alternate telecommunications services contingency plan primary and alternate telecommunications service agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities organizational personnel with knowledge of requirements for mission and business functions organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements Test Mechanisms supporting telecommunications
CP-08(01) [M] Priority of Service Provisions – Assessment Procedure	Assessment Objective Determine if: CP-08(01)(a) CP-08(01)(a)[01] primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed; CP-08(01)(a)[02] alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed; CP-08(01)(b) Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier. Assessment Methods Examine Contingency planning policy procedures addressing primary and alternate telecommunications services contingency plan primary and alternate telecommunications service agreements Telecommunications Service Priority documentation system security plan other relevant documents or records Interview Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities organizational personnel with information security responsibilities organizational personnel with responsibility for acquisitions/contractual agreements Test Mechanisms supporting telecommunications
CP-08(02) [M] Single Points of Failure – Assessment Procedure	Assessment Objective Determine if: CP-08(02) alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained. Assessment Methods Examine Contingency planning policy procedures addressing primary and alternate telecommunications services contingency plan primary and alternate telecommunications service agreements system security plan other relevant documents or records Interview Organizational personnel with contingency plan telecommunications responsibilities organizational personnel with system recovery responsibilities primary and alternate telecommunications service providers organizational personnel with information security responsibilities
CP-09 [M] System Backup – Assessment Procedure	Assessment Objective Determine if: CP-09a. backups of user-level information contained in [Assignment: system components] are conducted [Assignment: frequency]; CP-09b. backups of system-level information contained in the system are conducted [Assignment: frequency]; CP-09c. backups of system documentation, including security- and privacy-related documentation are conducted [Assignment: frequency]; CP-09d. CP-09d.[01] the confidentiality of backup information is protected; CP-09d.[02] the integrity of backup information is protected; CP-09d.[03] the availability of backup information is protected. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan backup storage location(s) system backup logs or records system security plan privacy plan other relevant documents or records Interview Organizational personnel with system backup responsibilities organizational personnel with information security and privacy responsibilities Test Organizational processes for conducting system backups mechanisms supporting and/or implementing system backups
CP-09(01) [M] Testing for Reliability and Integrity – Assessment Procedure	Assessment Objective Determine if: CP-09(01)[01] backup information is tested [Assignment: frequency] to verify media reliability; CP-09(01)[02] backup information is tested [Assignment: frequency] to verify information integrity. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test documentation contingency plan test results system security plan other relevant documents or records Interview Organizational personnel with system backup responsibilities organizational personnel with information security responsibilities Test Organizational processes for conducting system backups mechanisms supporting and/or implementing system backups
CP-09(08) [M] Cryptographic Protection – Assessment Procedure	Assessment Objective Determine if: CP-09(08) cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [Assignment: backup information]. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system design documentation system configuration settings and associated documentation system security plan other relevant documents or records Interview Organizational personnel with system backup responsibilities organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing cryptographic protection of backup information
CP-10 [M] System Recovery and Reconstitution – Assessment Procedure	Assessment Objective Determine if: CP-10[01] the recovery of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure; CP-10[02] a reconstitution of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test results contingency plan test documentation redundant secondary system for system backups location(s) of redundant secondary backup system(s) system security plan other relevant documents or records Interview Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities organizational personnel with information security responsibilities Test Organizational processes implementing system recovery and reconstitution operations mechanisms supporting and/or implementing system recovery and reconstitution operations
CP-10(02) [M] Transaction Recovery – Assessment Procedure	Assessment Objective Determine if: CP-10(02) transaction recovery is implemented for systems that are transaction-based. Assessment Methods Examine Contingency planning policy procedures addressing system recovery and reconstitution contingency plan system design documentation system configuration settings and associated documentation contingency plan test documentation contingency plan test results system transaction recovery records system audit records system security plan other relevant documents or records Interview Organizational personnel with responsibility for transaction recovery organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing transaction recovery capability
IA-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: IA-01a. IA-01a.[01] an identification and authentication policy is developed and documented; IA-01a.[02] the identification and authentication policy is disseminated to [Assignment: personnel or roles]; IA-01a.[03] identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed and documented; IA-01a.[04] the identification and authentication procedures are disseminated to [Assignment: personnel or roles]; IA-01a.01 IA-01a.01(a) IA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses purpose; IA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses scope; IA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses roles; IA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses responsibilities; IA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses management commitment; IA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses coordination among organizational entities; IA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy addresses compliance; IA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; IA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; IA-01c. IA-01c.01 IA-01c.01[01] the current identification and authentication policy is reviewed and updated [Assignment: frequency]; IA-01c.01[02] the current identification and authentication policy is reviewed and updated following [Assignment: events]; IA-01c.02 IA-01c.02[01] the current identification and authentication procedures are reviewed and updated [Assignment: frequency]; IA-01c.02[02] the current identification and authentication procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Identification and authentication policy and procedures system security plan privacy plan risk management strategy documentation list of events requiring identification and authentication procedures to be reviewed and updated (e.g., audit findings) other relevant documents or records Interview Organizational personnel with identification and authentication responsibilities organizational personnel with information security and privacy responsibilities
IA-02 [M] Identification and Authentication (Organizational Users) – Assessment Procedure	Assessment Objective Determine if: IA-02[01] organizational users are uniquely identified and authenticated; IA-02[02] the unique identification of authenticated organizational users is associated with processes acting on behalf of those users. Assessment Methods Examine Identification and authentication policy procedures addressing user identification and authentication system security plan, system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators organizational personnel with account management responsibilities system developers Test Organizational processes for uniquely identifying and authenticating users mechanisms supporting and/or implementing identification and authentication capabilities
IA-02(01) [M] Multi-factor Authentication to Privileged Accounts – Assessment Procedure	Assessment Objective Determine if: IA-02(01) multi-factor authentication is implemented for access to privileged accounts. Assessment Methods Examine Identification and authentication policy procedures addressing user identification and authentication system security plan system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing a multi-factor authentication capability
IA-02(02) [M] Multi-factor Authentication to Non-privileged Accounts – Assessment Procedure	Assessment Objective Determine if: IA-02(02) multi-factor authentication for access to non-privileged accounts is implemented. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing a multi-factor authentication capability
IA-02(08) [M] Access to Accounts — Replay Resistant – Assessment Procedure	Assessment Objective Determine if: IA-02(08) replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts] are implemented. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of privileged system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing identification and authentication capabilities Mechanisms supporting and/or implementing replay-resistant authentication mechanisms
IA-02(12) [M] Acceptance of PIV Credentials – Assessment Procedure	Assessment Objective Determine if: IA-02(12) Personal Identity Verification-compliant credentials are accepted and electronically verified. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records PIV verification records evidence of PIV credentials PIV credential authorizations other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with account management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing acceptance and verification of PIV credentials
IA-03 [M] Device Identification and Authentication – Assessment Procedure	Assessment Objective Determine if: IA-03 [Assignment: devices and/or types of devices] are uniquely identified and authenticated before establishing a [Selection (one or more): local; remote; network] connection. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing device identification and authentication system design documentation list of devices requiring unique identification and authentication device connection reports system configuration settings and associated documentation other relevant documents or records Interview Organizational personnel with operational responsibilities for device identification and authentication organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing device identification and authentication capabilities
IA-04 [M] Identifier Management – Assessment Procedure	Assessment Objective Determine if: IA-04a. system identifiers are managed by receiving authorization from [Assignment: personnel or roles] to assign to an individual, group, role, or device identifier; IA-04b. system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device; IA-04c. system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device; IA-04d. system identifiers are managed by preventing reuse of identifiers for [Assignment: time period]. Assessment Methods Examine Identification and authentication policy procedures addressing identifier management procedures addressing account management system security plan system design documentation system configuration settings and associated documentation list of system accounts list of identifiers generated from physical access control devices other relevant documents or records Interview Organizational personnel with identifier management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing identifier management
IA-04(04) [M] Identify User Status – Assessment Procedure	Assessment Objective Determine if: IA-04(04) individual identifiers are managed by uniquely identifying each individual as [Assignment: characteristics]. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing identifier management procedures addressing account management list of characteristics identifying individual status other relevant documents or records Interview Organizational personnel with identifier management responsibilities organizational personnel with information security responsibilities system/network administrators Test Mechanisms supporting and/or implementing identifier management
IA-05 [M] Authenticator Management – Assessment Procedure	Assessment Objective Determine if: IA-05a. system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution; IA-05b. system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization; IA-05c. system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use; IA-05d. system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators; IA-05e. system authenticators are managed through the change of default authenticators prior to first use; IA-05f. system authenticators are managed through the change or refreshment of authenticators [Assignment: time period by authenticator type] or when [Assignment: events] occur; IA-05g. system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification; IA-05h. IA-05h.[01] system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators; IA-05h.[02] system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators; IA-05i. system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes. Assessment Methods Examine Identification and authentication policy system security plan addressing authenticator management system design documentation system configuration settings and associated documentation list of system authenticator types change control records associated with managing system authenticators system audit records other relevant documents or records Interview Organizational personnel with authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators Test Mechanisms supporting and/or implementing authenticator management capability
IA-05(01) [M] Password-based Authentication – Assessment Procedure	Assessment Objective Determine if: IA-05(01)(a) for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [Assignment: frequency] and when organizational passwords are suspected to have been compromised directly or indirectly; IA-05(01)(b) for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a); IA-05(01)(c) for password-based authentication, passwords are only transmitted over cryptographically protected channels; IA-05(01)(d) for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash; IA-05(01)(e) for password-based authentication, immediate selection of a new password is required upon account recovery; IA-05(01)(f) for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters; IA-05(01)(g) for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators; IA-05(01)(h) for password-based authentication, [Assignment: composition and complexity rules] are enforced. Assessment Methods Examine Identification and authentication policy password policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation password configurations and associated documentation other relevant documents or records Interview Organizational personnel with authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing password-based authenticator management capability
IA-05(02) [M] Public Key-based Authentication – Assessment Procedure	Assessment Objective Determine if: IA-05(02)(a) IA-05(02)(a)(01) authorized access to the corresponding private key is enforced for public key-based authentication; IA-05(02)(a)(02) the authenticated identity is mapped to the account of the individual or group for public key-based authentication; IA-05(02)(b) IA-05(02)(b)(01) when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; IA-05(02)(b)(02) when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation. Assessment Methods Examine Identification and authentication policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation PKI certification validation records PKI certification revocation lists other relevant documents or records Interview Organizational personnel with PKI-based, authenticator management responsibilities organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing PKI-based, authenticator management capability
IA-05(06) [M] Protection of Authenticators – Assessment Procedure	Assessment Objective Determine if: IA-05(06) authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access. Assessment Methods Examine Identification and authentication policy procedures addressing authenticator management security categorization documentation for the system security assessments of authenticator protections risk assessment results system security plan other relevant documents or records Interview Organizational personnel with authenticator management responsibilities organizational personnel implementing and/or maintaining authenticator protections organizational personnel with information security responsibilities system/network administrators Test Mechanisms supporting and/or implementing authenticator management capability mechanisms protecting authenticators
IA-06 [M] Authentication Feedback – Assessment Procedure	Assessment Objective Determine if: IA-06 the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing authenticator feedback system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing the obscuring of feedback of authentication information during authentication
IA-07 [M] Cryptographic Module Authentication – Assessment Procedure	Assessment Objective Determine if: IA-07 mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing cryptographic module authentication system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with responsibility for cryptographic module authentication organizational personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing cryptographic module authentication
IA-08 [M] Identification and Authentication (Non-organizational Users) – Assessment Procedure	Assessment Objective Determine if: IA-08 non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated. Assessment Methods Examine Identification and authentication policy system security plan privacy plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of system accounts other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security and privacy responsibilities system/network administrators organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IA-08(01) [M] Acceptance of PIV Credentials from Other Agencies – Assessment Procedure	Assessment Objective Determine if: IA-08(01)[01] Personal Identity Verification-compliant credentials from other federal agencies are accepted; IA-08(01)[02] Personal Identity Verification-compliant credentials from other federal agencies are electronically verified. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records PIV verification records evidence of PIV credentials PIV credential authorizations other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities mechanisms that accept and verify PIV credentials
IA-08(02) [M] Acceptance of External Authenticators – Assessment Procedure	Assessment Objective Determine if: IA-08(02)(a) only external authenticators that are NIST-compliant are accepted; IA-08(02)(b) IA-08(02)(b)[01] a list of accepted external authenticators is documented; IA-08(02)(b)[02] a list of accepted external authenticators is maintained. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing user identification and authentication system design documentation system configuration settings and associated documentation system audit records list of third-party credentialing products, components, or services procured and implemented by organization third-party credential verification records evidence of third-party credentials third-party credential authorizations other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities mechanisms that accept external credentials
IA-08(04) [M] Use of Defined Profiles – Assessment Procedure	Assessment Objective Determine if: IA-08(04) there is conformance with [Assignment: identity management profiles] for identity management. Assessment Methods Examine Identification and authentication policy system security plan system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with account management responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities mechanisms supporting and/or implementing conformance with profiles
IA-11 [M] Re-authentication – Assessment Procedure	Assessment Objective Determine if: IA-11 users are required to re-authenticate when [Assignment: circumstances or situations]. Assessment Methods Examine Identification and authentication policy procedures addressing user and device re-authentication system security plan system design documentation system configuration settings and associated documentation list of circumstances or situations requiring re-authentication system audit records other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IA-12 [M] Identity Proofing – Assessment Procedure	Assessment Objective Determine if: IA-12a. users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed; IA-12b. user identities are resolved to a unique individual; IA-12c. IA-12c.[01] identity evidence is collected; IA-12c.[02] identity evidence is validated; IA-12c.[03] identity evidence is verified. Assessment Methods Examine Identification and authentication policy procedures addressing identity proofing system security plan privacy plan other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security and privacy responsibilities legal counsel system/network administrators system developers organizational personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IA-12(02) [M] Identity Evidence – Assessment Procedure	Assessment Objective Determine if: IA-12(02) evidence of individual identification is presented to the registration authority. Assessment Methods Examine Identification and authentication policy procedures addressing identity proofing system security plan other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IA-12(03) [M] Identity Evidence Validation and Verification – Assessment Procedure	Assessment Objective Determine if: IA-12(03) the presented identity evidence is validated and verified through [Assignment: methods of validation and verification]. Assessment Methods Examine Identification and authentication policy procedures addressing identity proofing system security plan other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IA-12(05) [M] Address Confirmation – Assessment Procedure	Assessment Objective Determine if: IA-12(05) a [Selection: registration code; notice of proofing] is delivered through an out-of-band channel to verify the user’s address (physical or digital) of record. Assessment Methods Examine Identification and authentication policy procedures addressing identity proofing system security plan other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators system developers organizational personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
IR-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: IR-01a. IR-01a.[01] an incident response policy is developed and documented; IR-01a.[02] the incident response policy is disseminated to [Assignment: personnel or roles]; IR-01a.[03] incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented; IR-01a.[04] the incident response procedures are disseminated to [Assignment: personnel or roles]; IR-01a.01 IR-01a.01(a) IR-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses purpose; IR-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses scope; IR-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses roles; IR-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses responsibilities; IR-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses management commitment; IR-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses coordination among organizational entities; IR-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses compliance; IR-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; IR-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures; IR-01c. IR-01c.01 IR-01c.01[01] the current incident response policy is reviewed and updated [Assignment: frequency]; IR-01c.01[02] the current incident response policy is reviewed and updated following [Assignment: events]; IR-01c.02 IR-01c.02[01] the current incident response procedures are reviewed and updated [Assignment: frequency]; IR-01c.02[02] the current incident response procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Incident response policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response responsibilities organizational personnel with information security and privacy responsibilities
IR-02 [M] Incident Response Training – Assessment Procedure	Assessment Objective Determine if: IR-02a. IR-02a.01 incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access; IR-02a.02 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes; IR-02a.03 incident response training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter; IR-02b. IR-02b.[01] incident response training content is reviewed and updated [Assignment: frequency]; IR-02b.[02] incident response training content is reviewed and updated following [Assignment: events]. Assessment Methods Examine Incident response policy procedures addressing incident response training incident response training curriculum incident response training materials privacy plan incident response plan incident response training records system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response training and operational responsibilities organizational personnel with information security and privacy responsibilities
IR-03 [M] Incident Response Testing – Assessment Procedure	Assessment Objective Determine if: IR-03 the effectiveness of the incident response capability for the system is tested [Assignment: frequency] using [Assignment: tests]. Assessment Methods Examine Incident response policy contingency planning policy procedures addressing incident response testing procedures addressing contingency plan testing incident response testing material incident response test results incident response test plan incident response plan contingency plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response testing responsibilities organizational personnel with information security and privacy responsibilities
IR-03(02) [M] Coordination with Related Plans – Assessment Procedure	Assessment Objective Determine if: IR-03(02) incident response testing is coordinated with organizational elements responsible for related plans. Assessment Methods Examine Incident response policy contingency planning policy procedures addressing incident response testing incident response testing documentation incident response plan business continuity plans contingency plans disaster recovery plans continuity of operations plans crisis communications plans critical infrastructure plans occupant emergency plans system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response testing responsibilities organizational personnel with responsibilities for testing organizational plans related to incident response testing organizational personnel with information security and privacy responsibilities
IR-04 [M] Incident Handling – Assessment Procedure	Assessment Objective Determine if: IR-04a. IR-04a.[01] an incident handling capability for incidents is implemented that is consistent with the incident response plan; IR-04a.[02] the incident handling capability for incidents includes preparation; IR-04a.[03] the incident handling capability for incidents includes detection and analysis; IR-04a.[04] the incident handling capability for incidents includes containment; IR-04a.[05] the incident handling capability for incidents includes eradication; IR-04a.[06] the incident handling capability for incidents includes recovery; IR-04b. incident handling activities are coordinated with contingency planning activities; IR-04c. IR-04c.[01] lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing; IR-04c.[02] the changes resulting from the incorporated lessons learned are implemented accordingly; IR-04d. IR-04d.[01] the rigor of incident handling activities is comparable and predictable across the organization; IR-04d.[02] the intensity of incident handling activities is comparable and predictable across the organization; IR-04d.[03] the scope of incident handling activities is comparable and predictable across the organization; IR-04d.[04] the results of incident handling activities are comparable and predictable across the organization. Assessment Methods Examine Incident response policy contingency planning policy procedures addressing incident handling incident response plan contingency plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident handling responsibilities organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities Test Incident handling capability for the organization
IR-04(01) [M] Automated Incident Handling Processes – Assessment Procedure	Assessment Objective Determine if: IR-04(01) the incident handling process is supported using [Assignment: automated mechanisms]. Assessment Methods Examine Incident response policy procedures addressing incident handling automated mechanisms supporting incident handling system design documentation system configuration settings and associated documentation system audit records incident response plan system security plan other relevant documents or records Interview Organizational personnel with incident handling responsibilities organizational personnel with information security responsibilities Test Automated mechanisms that support and/or implement the incident handling process
IR-05 [M] Incident Monitoring – Assessment Procedure	Assessment Objective Determine if: IR-05[01] incidents are tracked; IR-05[02] incidents are documented. Assessment Methods Examine Incident response policy procedures addressing incident monitoring incident response records and documentation incident response plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident monitoring responsibilities organizational personnel with information security and privacy responsibilities Test Incident monitoring capability for the organization mechanisms supporting and/or implementing the tracking and documenting of system security incidents
IR-06 [M] Incident Reporting – Assessment Procedure	Assessment Objective Determine if: IR-06a. personnel is/are required to report suspected incidents to the organizational incident response capability within [Assignment: time period]; IR-06b. incident information is reported to [Assignment: authorities]. Assessment Methods Examine Incident response policy procedures addressing incident reporting incident reporting records and documentation incident response plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident reporting responsibilities organizational personnel with information security and privacy responsibilities personnel who have/should have reported incidents personnel (authorities) to whom incident information is to be reported system users Test Organizational processes for incident reporting mechanisms supporting and/or implementing incident reporting
IR-06(01) [M] Automated Reporting – Assessment Procedure	Assessment Objective Determine if: IR-06(01) incidents are reported using [Assignment: automated mechanisms]. Assessment Methods Examine Incident response policy procedures addressing incident reporting automated mechanisms supporting incident reporting system design documentation system configuration settings and associated documentation incident response plan system security plan other relevant documents or records Interview Organizational personnel with incident reporting responsibilities organizational personnel with information security responsibilities Test Organizational processes for incident reporting automated mechanisms supporting and/or implementing the reporting of security incidents
IR-06(03) [M] Supply Chain Coordination – Assessment Procedure	Assessment Objective Determine if: IR-06(03) incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident. Assessment Methods Examine Incident response policy procedures addressing supply chain coordination and supply chain risk information sharing with the Federal Acquisition Security Council acquisition policy acquisition contracts service-level agreements incident response plan supply chain risk management plan system security plan plans of other organizations involved in supply chain activities other relevant documents or records Interview Organizational personnel with incident reporting responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organization personnel with acquisition responsibilities Test Organizational processes for incident reporting organizational processes for supply chain risk information sharing mechanisms supporting and/or implementing the reporting of incident information involved in the supply chain
IR-07 [M] Incident Response Assistance – Assessment Procedure	Assessment Objective Determine if: IR-07[01] an incident response support resource, integral to the organizational incident response capability, is provided; IR-07[02] the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents. Assessment Methods Examine Incident response policy procedures addressing incident response assistance incident response plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with incident response assistance and support responsibilities organizational personnel with access to incident response support and assistance capability organizational personnel with information security and privacy responsibilities Test Organizational processes for incident response assistance mechanisms supporting and/or implementing incident response assistance
IR-07(01) [M] Automation Support for Availability of Information and Support – Assessment Procedure	Assessment Objective Determine if: IR-07(01) the availability of incident response information and support is increased using [Assignment: automated mechanisms]. Assessment Methods Examine Incident response policy procedures addressing incident response assistance automated mechanisms supporting incident response support and assistance system design documentation system configuration settings and associated documentation incident response plan system security plan other relevant documents or records Interview Organizational personnel with incident response support and assistance responsibilities organizational personnel with access to incident response support and assistance capability organizational personnel with information security responsibilities Test Organizational processes for incident response assistance automated mechanisms supporting and/or implementing an increase in the availability of incident response information and support
IR-08 [M] Incident Response Plan – Assessment Procedure	Assessment Objective Determine if: IR-08a. IR-08a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability; IR-08a.02 an incident response plan is developed that describes the structure and organization of the incident response capability; IR-08a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization; IR-08a.04 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions; IR-08a.05 an incident response plan is developed that defines reportable incidents; IR-08a.06 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization; IR-08a.07 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability; IR-08a.08 an incident response plan is developed that addresses the sharing of incident information; IR-08a.09 an incident response plan is developed that is reviewed and approved by [Assignment: personnel or roles] [Assignment: frequency]; IR-08a.10 an incident response plan is developed that explicitly designates responsibility for incident response to [Assignment: entities, personnel, or roles]. IR-08b. IR-08b.[01] copies of the incident response plan are distributed to [Assignment: incident response personnel]; IR-08b.[02] copies of the incident response plan are distributed to [Assignment: organizational elements]; IR-08c. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing; IR-08d. IR-08d.[01] incident response plan changes are communicated to [Assignment: incident response personnel]; IR-08d.[02] incident response plan changes are communicated to [Assignment: organizational elements]; IR-08e. IR-08e.[01] the incident response plan is protected from unauthorized disclosure; IR-08e.[02] the incident response plan is protected from unauthorized modification. Assessment Methods Examine Incident response policy procedures addressing incident response planning incident response plan system security plan privacy plan records of incident response plan reviews and approvals other relevant documents or records Interview Organizational personnel with incident response planning responsibilities organizational personnel with information security and privacy responsibilities Test Organizational incident response plan and related organizational processes
MA-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: MA-01a. MA-01a.[01] a maintenance policy is developed and documented; MA-01a.[02] the maintenance policy is disseminated to [Assignment: personnel or roles]; MA-01a.[03] maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented; MA-01a.[04] the maintenance procedures are disseminated to [Assignment: personnel or roles]; MA-01a.01 MA-01a.01(a) MA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses purpose; MA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses scope; MA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses roles; MA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses responsibilities; MA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses management commitment; MA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses coordination among organizational entities; MA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy addresses compliance; MA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; MA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures; MA-01c. MA-01c.01 MA-01c.01[01] the current maintenance policy is reviewed and updated [Assignment: frequency]; MA-01c.01[02] the current maintenance policy is reviewed and updated following [Assignment: events]; MA-01c.02 MA-01c.02[01] the current maintenance procedures are reviewed and updated [Assignment: frequency]; MA-01c.02[02] the current maintenance procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Maintenance policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records Interview Organizational personnel with maintenance responsibilities organizational personnel with information security and privacy responsibilities
MA-02 [M] Controlled Maintenance – Assessment Procedure	Assessment Objective Determine if: MA-02a. MA-02a.[01] maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-02a.[02] maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-02a.[03] records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements; MA-02b. MA-02b.[01] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved; MA-02b.[02] all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored; MA-02c. [Assignment: personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; MA-02d. equipment is sanitized to remove [Assignment: information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement; MA-02e. all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; MA-02f. [Assignment: information] is included in organizational maintenance records. Assessment Methods Examine Maintenance policy procedures addressing controlled system maintenance maintenance records manufacturer/vendor maintenance specifications equipment sanitization records media sanitization records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities organizational personnel responsible for media sanitization system/network administrators Test Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the system organizational processes for sanitizing system components mechanisms supporting and/or implementing controlled maintenance mechanisms implementing the sanitization of system components
MA-03 [M] Maintenance Tools – Assessment Procedure	Assessment Objective Determine if: MA-03a. MA-03a.[01] the use of system maintenance tools is approved; MA-03a.[02] the use of system maintenance tools is controlled; MA-03a.[03] the use of system maintenance tools is monitored; MA-03b. previously approved system maintenance tools are reviewed [Assignment: frequency]. Assessment Methods Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities Test Organizational processes for approving, controlling, and monitoring maintenance tools mechanisms supporting and/or implementing the approval, control, and/or monitoring of maintenance tools
MA-03(01) [M] Inspect Tools – Assessment Procedure	Assessment Objective Determine if: MA-03(01) maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications. Assessment Methods Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance tool inspection records maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities Test Organizational processes for inspecting maintenance tools mechanisms supporting and/or implementing the inspection of maintenance tools
MA-03(02) [M] Inspect Media – Assessment Procedure	Assessment Objective Determine if: MA-03(02) media containing diagnostic and test programs are checked for malicious code before the media are used in the system. Assessment Methods Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities Test Organizational process for inspecting media for malicious code mechanisms supporting and/or implementing the inspection of media used for maintenance
MA-03(03) [M] Prevent Unauthorized Removal – Assessment Procedure	Assessment Objective Determine if: MA-03(03)(a) the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment; or MA-03(03)(b) the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment; or MA-03(03)(c) the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility; or MA-03(03)(d) the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [Assignment: personnel or roles] explicitly authorizing removal of the equipment from the facility. Assessment Methods Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation maintenance records equipment sanitization records media sanitization records exemptions for equipment removal system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities organizational personnel responsible for media sanitization Test Organizational process for preventing unauthorized removal of information mechanisms supporting media sanitization or destruction of equipment mechanisms supporting verification of media sanitization
MA-04 [M] Nonlocal Maintenance – Assessment Procedure	Assessment Objective Determine if: MA-04a. MA-04a.[01] nonlocal maintenance and diagnostic activities are approved; MA-04a.[02] nonlocal maintenance and diagnostic activities are monitored; MA-04b. MA-04b.[01] the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy; MA-04b.[02] the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system; MA-04c. strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions; MA-04d. records for nonlocal maintenance and diagnostic activities are maintained; MA-04e. MA-04e.[01] session connections are terminated when nonlocal maintenance is completed; MA-04e.[02] network connections are terminated when nonlocal maintenance is completed. Assessment Methods Examine Maintenance policy procedures addressing nonlocal system maintenance remote access policy remote access procedures system design documentation system configuration settings and associated documentation maintenance records records of remote access diagnostic records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for managing nonlocal maintenance mechanisms implementing, supporting, and/or managing nonlocal maintenance mechanisms for strong authentication of nonlocal maintenance diagnostic sessions mechanisms for terminating nonlocal maintenance sessions and network connections
MA-05 [M] Maintenance Personnel – Assessment Procedure	Assessment Objective Determine if: MA-05a. MA-05a.[01] a process for maintenance personnel authorization is established; MA-05a.[02] a list of authorized maintenance organizations or personnel is maintained; MA-05b. non-escorted personnel performing maintenance on the system possess the required access authorizations; MA-05c. organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations. Assessment Methods Examine Maintenance policy procedures addressing maintenance personnel service provider contracts service-level agreements list of authorized personnel maintenance records access control records system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with information security responsibilities Test Organizational processes for authorizing and managing maintenance personnel mechanisms supporting and/or implementing authorization of maintenance personnel
MA-06 [M] Timely Maintenance – Assessment Procedure	Assessment Objective Determine if: MA-06 maintenance support and/or spare parts are obtained for [Assignment: system components] within [Assignment: time period] of failure. Assessment Methods Examine Maintenance policy procedures addressing system maintenance service provider contracts service-level agreements inventory and availability of spare parts system security plan other relevant documents or records Interview Organizational personnel with system maintenance responsibilities organizational personnel with acquisition responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for ensuring timely maintenance
MP-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: MP-01a. MP-01a.[01] a media protection policy is developed and documented; MP-01a.[02] the media protection policy is disseminated to [Assignment: personnel or roles]; MP-01a.[03] media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented; MP-01a.[04] the media protection procedures are disseminated to [Assignment: personnel or roles]; MP-01a.01 MP-01a.01(a) MP-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses purpose; MP-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses scope; MP-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses roles; MP-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses responsibilities; MP-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses management commitment; MP-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses coordination among organizational entities; MP-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy compliance; MP-01a.01(b) the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; MP-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures. MP-01c. MP-01c.01 MP-01c.01[01] the current media protection policy is reviewed and updated [Assignment: frequency]; MP-01c.01[02] the current media protection policy is reviewed and updated following [Assignment: events]; MP-01c.02 MP-01c.02[01] the current media protection procedures are reviewed and updated [Assignment: frequency]; MP-01c.02[02] the current media protection procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Media protection policy and procedures organizational risk management strategy system security plan privacy plan other relevant documents or records Interview Organizational personnel with media protection responsibilities organizational personnel with information security and privacy responsibilities
MP-02 [M] Media Access – Assessment Procedure	Assessment Objective Determine if: MP-02[01] access to [Assignment: types of digital media] is restricted to [Assignment: personnel or roles]; MP-02[02] access to [Assignment: types of non-digital media] is restricted to [Assignment: personnel or roles]. Assessment Methods Examine System media protection policy procedures addressing media access restrictions access control policy and procedures physical and environmental protection policy and procedures media storage facilities access control records system security plan other relevant documents or records Interview Organizational personnel with system media protection responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for restricting information media mechanisms supporting and/or implementing media access restrictions
MP-03 [M] Media Marking – Assessment Procedure	Assessment Objective Determine if: MP-03a. system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information; MP-03b. [Assignment: types of media exempted from marking] remain within [Assignment: controlled areas]. Assessment Methods Examine System media protection policy procedures addressing media marking physical and environmental protection policy and procedures list of system media marking security attributes designated controlled areas system security plan other relevant documents or records Interview Organizational personnel with system media protection and marking responsibilities organizational personnel with information security responsibilities Test Organizational processes for marking information media mechanisms supporting and/or implementing media marking
MP-04 [M] Media Storage – Assessment Procedure	Assessment Objective Determine if: MP-04a. MP-04a.[01] [Assignment: types of digital media] are physically controlled; MP-04a.[02] [Assignment: types of non-digital media] are physically controlled; MP-04a.[03] [Assignment: types of digital media] are securely stored within [Assignment: controlled areas]; MP-04a.[04] [Assignment: types of non-digital media] are securely stored within [Assignment: controlled areas]; MP-04b. system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures. Assessment Methods Examine System media protection policy procedures addressing media storage physical and environmental protection policy and procedures access control policy and procedures system media designated controlled areas system security plan other relevant documents or records Interview Organizational personnel with system media protection and storage responsibilities organizational personnel with information security responsibilities Test Organizational processes for storing information media mechanisms supporting and/or implementing secure media storage/media protection
MP-05 [M] Media Transport – Assessment Procedure	Assessment Objective Determine if: MP-05a. MP-05a.[01] [Assignment: types of system media] are protected during transport outside of controlled areas using [Assignment: controls]; MP-05a.[02] [Assignment: types of system media] are controlled during transport outside of controlled areas using [Assignment: controls]; MP-05b. accountability for system media is maintained during transport outside of controlled areas; MP-05c. activities associated with the transport of system media are documented; MP-05d. MP-05d.[01] personnel authorized to conduct media transport activities is/are identified; MP-05d.[02] activities associated with the transport of system media are restricted to identified authorized personnel. Assessment Methods Examine System media protection policy procedures addressing media storage physical and environmental protection policy and procedures access control policy and procedures authorized personnel list system media designated controlled areas system security plan other relevant documents or records Interview Organizational personnel with system media protection and storage responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for storing information media mechanisms supporting and/or implementing media storage/media protection
MP-06 [M] Media Sanitization – Assessment Procedure	Assessment Objective Determine if: MP-06a. MP-06a.[01] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to disposal; MP-06a.[02] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release from organizational control; MP-06a.[03] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release for reuse; MP-06b. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed. Assessment Methods Examine System media protection policy procedures addressing media sanitization and disposal applicable federal standards and policies addressing media sanitization policy media sanitization records system audit records system design documentation records retention and disposition policy records retention and disposition procedures system configuration settings and associated documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with media sanitization responsibilities organizational personnel with records retention and disposition responsibilities organizational personnel with information security and privacy responsibilities system/network administrators Test Organizational processes for media sanitization mechanisms supporting and/or implementing media sanitization
MP-07 [M] Media Use – Assessment Procedure	Assessment Objective Determine if: MP-07a. the use of [Assignment: types of system media] is [Selection: restrict; prohibit] on [Assignment: systems or system components] using [Assignment: controls]; MP-07b. the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner. Assessment Methods Examine System media protection policy system use policy procedures addressing media usage restrictions rules of behavior system design documentation system configuration settings and associated documentation audit records system security plan other relevant documents or records Interview Organizational personnel with system media use responsibilities organizational personnel with information security responsibilities system/network administrators Test Organizational processes for media use mechanisms restricting or prohibiting the use of system media on systems or system components
PE-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: PE-01a. PE-01a.[01] a physical and environmental protection policy is developed and documented; PE-01a.[02] the physical and environmental protection policy is disseminated to [Assignment: personnel or roles]; PE-01a.[03] physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented; PE-01a.[04] the physical and environmental protection procedures are disseminated to [Assignment: personnel or roles]; PE-01a.01 PE-01a.01(a) PE-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses purpose; PE-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses scope; PE-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses roles; PE-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses responsibilities; PE-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses management commitment; PE-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses coordination among organizational entities; PE-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy addresses compliance; PE-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; PE-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; PE-01c. PE-01c.01 PE-01c.01[01] the current physical and environmental protection policy is reviewed and updated [Assignment: frequency]; PE-01c.01[02] the current physical and environmental protection policy is reviewed and updated following [Assignment: events]; PE-01c.02 PE-01c.02[01] the current physical and environmental protection procedures are reviewed and updated [Assignment: frequency]; PE-01c.02[02] the current physical and environmental protection procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Physical and environmental protection policy and procedures system security plan privacy plan organizational risk management strategy other relevant documents or records Interview Organizational personnel with physical and environmental protection responsibilities organizational personnel with information security and privacy responsibilities
PE-02 [M] Physical Access Authorizations – Assessment Procedure	Assessment Objective Determine if: PE-02a. PE-02a.[01] a list of individuals with authorized access to the facility where the system resides has been developed; PE-02a.[02] the list of individuals with authorized access to the facility where the system resides has been approved; PE-02a.[03] the list of individuals with authorized access to the facility where the system resides has been maintained; PE-02b. authorization credentials are issued for facility access; PE-02c. the access list detailing authorized facility access by individuals is reviewed [Assignment: frequency]; PE-02d. individuals are removed from the facility access list when access is no longer required. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access authorizations authorized personnel access list authorization credentials physical access list reviews physical access termination records and associated documentation system security plan other relevant documents or records Interview Organizational personnel with physical access authorization responsibilities organizational personnel with physical access to system facility organizational personnel with information security responsibilities Test Organizational processes for physical access authorizations mechanisms supporting and/or implementing physical access authorizations
PE-03 [M] Physical Access Control – Assessment Procedure	Assessment Objective Determine if: PE-03a. PE-03a.01 physical access authorizations are enforced at [Assignment: entry and exit points] by verifying individual access authorizations before granting access to the facility; PE-03a.02 physical access authorizations are enforced at [Assignment: entry and exit points] by controlling ingress and egress to the facility using [Selection (one or more): [Assignment: systems or devices] ; guards]; PE-03b. physical access audit logs are maintained for [Assignment: entry or exit points]; PE-03c. access to areas within the facility designated as publicly accessible are maintained by implementing [Assignment: physical access controls]; PE-03d. PE-03d.[01] visitors are escorted; PE-03d.[02] visitor activity is controlled [Assignment: circumstances]; PE-03e. PE-03e.[01] keys are secured; PE-03e.[02] combinations are secured; PE-03e.[03] other physical access devices are secured; PE-03f. [Assignment: physical access devices] are inventoried [Assignment: frequency]; PE-03g. PE-03g.[01] combinations are changed [Assignment: frequency] , when combinations are compromised, or when individuals possessing the combinations are transferred or terminated; PE-03g.[02] keys are changed [Assignment: frequency] , when keys are lost, or when individuals possessing the keys are transferred or terminated. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access control physical access control logs or records inventory records of physical access control devices system entry and exit points records of key and lock combination changes storage locations for physical access control devices physical access control devices list of security safeguards controlling access to designated publicly accessible areas within facility system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities Test Organizational processes for physical access control mechanisms supporting and/or implementing physical access control physical access control devices
PE-04 [M] Access Control for Transmission – Assessment Procedure	Assessment Objective Determine if: PE-04 physical access to [Assignment: system distribution and transmission lines] within organizational facilities is controlled using [Assignment: security controls]. Assessment Methods Examine Physical and environmental protection policy procedures addressing access control for transmission mediums system design documentation facility communications and wiring diagrams list of physical security safeguards applied to system distribution and transmission lines system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities Test Organizational processes for access control to distribution and transmission lines mechanisms/security safeguards supporting and/or implementing access control to distribution and transmission lines
PE-05 [M] Access Control for Output Devices – Assessment Procedure	Assessment Objective Determine if: PE-05 physical access to output from [Assignment: output devices] is controlled to prevent unauthorized individuals from obtaining the output. Assessment Methods Examine Physical and environmental protection policy procedures addressing access control for display medium facility layout of system components actual displays from system components list of output devices and associated outputs requiring physical access controls physical access control logs or records for areas containing output devices and related outputs system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities Test Organizational processes for access control to output devices mechanisms supporting and/or implementing access control to output devices
PE-06 [M] Monitoring Physical Access – Assessment Procedure	Assessment Objective Determine if: PE-06a. physical access to the facility where the system resides is monitored to detect and respond to physical security incidents; PE-06b. PE-06b.[01] physical access logs are reviewed [Assignment: frequency]; PE-06b.[02] physical access logs are reviewed upon occurrence of [Assignment: events]; PE-06c. PE-06c.[01] results of reviews are coordinated with organizational incident response capabilities; PE-06c.[02] results of investigations are coordinated with organizational incident response capabilities. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access monitoring physical access logs or records physical access monitoring records physical access log reviews system security plan other relevant documents or records Interview Organizational personnel with physical access monitoring responsibilities organizational personnel with incident response responsibilities organizational personnel with information security responsibilities Test Organizational processes for monitoring physical access mechanisms supporting and/or implementing physical access monitoring mechanisms supporting and/or implementing the review of physical access logs
PE-06(01) [M] Intrusion Alarms and Surveillance Equipment – Assessment Procedure	Assessment Objective Determine if: PE-06(01)[01] physical access to the facility where the system resides is monitored using physical intrusion alarms; PE-06(01)[02] physical access to the facility where the system resides is monitored using physical surveillance equipment. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access monitoring physical access logs or records physical access monitoring records physical access log reviews system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with physical access monitoring responsibilities organizational personnel with incident response responsibilities organizational personnel with information security and privacy responsibilities Test Organizational processes for monitoring physical intrusion alarms and surveillance equipment mechanisms supporting and/or implementing physical access monitoring mechanisms supporting and/or implementing physical intrusion alarms and surveillance equipment
PE-08 [M] Visitor Access Records – Assessment Procedure	Assessment Objective Determine if: PE-08a. visitor access records for the facility where the system resides are maintained for [Assignment: time period]; PE-08b. visitor access records are reviewed [Assignment: frequency]; PE-08c. visitor access records anomalies are reported to [Assignment: personnel]. Assessment Methods Examine Physical and environmental protection policy procedures addressing visitor access records visitor access control logs or records visitor access record or log reviews system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with visitor access record responsibilities organizational personnel with information security and privacy responsibilities Test Organizational processes for maintaining and reviewing visitor access records mechanisms supporting and/or implementing the maintenance and review of visitor access records
PE-09 [M] Power Equipment and Cabling – Assessment Procedure	Assessment Objective Determine if: PE-09[01] power equipment for the system is protected from damage and destruction; PE-09[02] power cabling for the system is protected from damage and destruction. Assessment Methods Examine Physical and environmental protection policy procedures addressing power equipment/cabling protection facilities housing power equipment/cabling system security plan other relevant documents or records Interview Organizational personnel with the responsibility to protect power equipment/cabling organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing the protection of power equipment/cabling
PE-10 [M] Emergency Shutoff – Assessment Procedure	Assessment Objective Determine if: PE-10a. the capability to shut off power to [Assignment: system or individual system components] in emergency situations is provided; PE-10b. emergency shutoff switches or devices are placed in [Assignment: location] to facilitate access for authorized personnel; PE-10c. the emergency power shutoff capability is protected from unauthorized activation. Assessment Methods Examine Physical and environmental protection policy procedures addressing power source emergency shutoff emergency shutoff controls or switches locations housing emergency shutoff switches and devices security safeguards protecting the emergency power shutoff capability from unauthorized activation system security plan other relevant documents or records Interview Organizational personnel with the responsibility for the emergency power shutoff capability (both implementing and using the capability) organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing emergency power shutoff
PE-11 [M] Emergency Power – Assessment Procedure	Assessment Objective Determine if: PE-11 an uninterruptible power supply is provided to facilitate [Selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss. Assessment Methods Examine Physical and environmental protection policy procedures addressing emergency power uninterruptible power supply uninterruptible power supply documentation uninterruptible power supply test records system security plan other relevant documents or records Interview Organizational personnel with the responsibility for emergency power and/or planning organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing an uninterruptible power supply the uninterruptable power supply
PE-12 [M] Emergency Lighting – Assessment Procedure	Assessment Objective Determine if: PE-12[01] automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system; PE-12[02] automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system; PE-12[03] automatic emergency lighting for the system covers emergency exits within the facility; PE-12[04] automatic emergency lighting for the system covers evacuation routes within the facility. Assessment Methods Examine Physical and environmental protection policy procedures addressing emergency lighting emergency lighting documentation emergency lighting test records emergency exits and evacuation routes system security plan other relevant documents or records Interview Organizational personnel with the responsibility for emergency lighting and/or planning organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing an emergency lighting capability
PE-13 [M] Fire Protection – Assessment Procedure	Assessment Objective Determine if: PE-13[01] fire detection systems are employed; PE-13[02] employed fire detection systems are supported by an independent energy source; PE-13[03] employed fire detection systems are maintained; PE-13[04] fire suppression systems are employed; PE-13[05] employed fire suppression systems are supported by an independent energy source; PE-13[06] employed fire suppression systems are maintained. Assessment Methods Examine Physical and environmental protection policy procedures addressing fire protection fire suppression and detection devices/systems fire suppression and detection devices/systems documentation test records of fire suppression and detection devices/systems system security plan other relevant documents or records Interview Organizational personnel with responsibilities for fire detection and suppression devices/systems organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing fire suppression/detection devices/systems
PE-13(01) [M] Detection Systems — Automatic Activation and Notification – Assessment Procedure	Assessment Objective Determine if: PE-13(01)[01] fire detection systems that activate automatically are employed in the event of a fire; PE-13(01)[02] fire detection systems that notify [Assignment: personnel or roles] automatically are employed in the event of a fire; PE-13(01)[03] fire detection systems that notify [Assignment: emergency responders] automatically are employed in the event of a fire. Assessment Methods Examine Physical and environmental protection policy procedures addressing fire protection facility housing the information system alarm service-level agreements test records of fire suppression and detection devices/systems fire suppression and detection devices/systems documentation alerts/notifications of fire events system security plan other relevant documents or records Interview Organizational personnel with responsibilities for fire detection and suppression devices/systems organizational personnel with responsibilities for notifying appropriate personnel, roles, and emergency responders of fires organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing fire detection devices/systems activation of fire detection devices/systems (simulated) automated notifications
PE-14 [M] Environmental Controls – Assessment Procedure	Assessment Objective Determine if: PE-14a. [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: environmental control] ] levels are maintained at [Assignment: acceptable levels] within the facility where the system resides; PE-14b. environmental control levels are monitored [Assignment: frequency]. Assessment Methods Examine Physical and environmental protection policy procedures addressing temperature and humidity control temperature and humidity controls facility housing the system temperature and humidity controls documentation temperature and humidity records system security plan other relevant documents or records Interview Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing the maintenance and monitoring of temperature and humidity levels
PE-15 [M] Water Damage Protection – Assessment Procedure	Assessment Objective Determine if: PE-15[01] the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves; PE-15[02] the master shutoff or isolation valves are accessible; PE-15[03] the master shutoff or isolation valves are working properly; PE-15[04] the master shutoff or isolation valves are known to key personnel. Assessment Methods Examine Physical and environmental protection policy procedures addressing water damage protection facility housing the system master shutoff valves list of key personnel with knowledge of location and activation procedures for master shutoff valves for the plumbing system master shutoff valve documentation system security plan other relevant documents or records Interview Organizational personnel with responsibilities for system environmental controls organizational personnel with information security responsibilities Test Master water-shutoff valves organizational process for activating master water shutoff
PE-16 [M] Delivery and Removal – Assessment Procedure	Assessment Objective Determine if: PE-16a. PE-16a.[01] [Assignment: types of system components] are authorized when entering the facility; PE-16a.[02] [Assignment: types of system components] are controlled when entering the facility; PE-16a.[03] [Assignment: types of system components] are authorized when exiting the facility; PE-16a.[04] [Assignment: types of system components] are controlled when exiting the facility; PE-16b. records of the system components are maintained. Assessment Methods Examine Physical and environmental protection policy procedures addressing the delivery and removal of system components from the facility facility housing the system records of items entering and exiting the facility system security plan other relevant documents or records Interview Organizational personnel with responsibilities for controlling system components entering and exiting the facility organizational personnel with information security responsibilities Test Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility
PE-17 [M] Alternate Work Site – Assessment Procedure	Assessment Objective Determine if: PE-17a. [Assignment: alternate work sites] are determined and documented; PE-17b. [Assignment: controls] are employed at alternate work sites; PE-17c. the effectiveness of controls at alternate work sites is assessed; PE-17d. a means for employees to communicate with information security and privacy personnel in case of incidents is provided. Assessment Methods Examine Physical and environmental protection policy procedures addressing alternate work sites for organizational personnel list of security controls required for alternate work sites assessments of security controls at alternate work sites system security plan privacy plan other relevant documents or records Interview Organizational personnel approving the use of alternate work sites organizational personnel using alternate work sites organizational personnel assessing controls at alternate work sites organizational personnel with information security and privacy responsibilities Test Organizational processes for security and privacy at alternate work sites mechanisms supporting alternate work sites security and privacy controls employed at alternate work sites means of communication between personnel at alternate work sites and security and privacy personnel
PL-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: PL-01a. PL-01a.[01] a planning policy is developed and documented. PL-01a.[02] the planning policy is disseminated to [Assignment: personnel or roles]; PL-01a.[03] planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented; PL-01a.[04] the planning procedures are disseminated to [Assignment: personnel or roles]; PL-01a.01 PL-01a.01(a) PL-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses purpose; PL-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses scope; PL-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses roles; PL-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses responsibilities; PL-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses management commitment; PL-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses coordination among organizational entities; PL-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses compliance; PL-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; PL-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the planning policy and procedures; PL-01c. PL-01c.01 PL-01c.01[01] the current planning policy is reviewed and updated [Assignment: frequency]; PL-01c.01[02] the current planning policy is reviewed and updated following [Assignment: events]; PL-01c.02 PL-01c.02[01] the current planning procedures are reviewed and updated [Assignment: frequency]; PL-01c.02[02] the current planning procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Planning policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with planning responsibilities organizational personnel with information security and privacy responsibilities
PL-02 [M] System Security and Privacy Plans – Assessment Procedure	Assessment Objective Determine if: PL-02a. PL-02a.01 PL-02a.01[01] a security plan for the system is developed that is consistent with the organization’s enterprise architecture; PL-02a.01[02] a privacy plan for the system is developed that is consistent with the organization’s enterprise architecture; PL-02a.02 PL-02a.02[01] a security plan for the system is developed that explicitly defines the constituent system components; PL-02a.02[02] a privacy plan for the system is developed that explicitly defines the constituent system components; PL-02a.03 PL-02a.03[01] a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes; PL-02a.03[02] a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes; PL-02a.04 PL-02a.04[01] a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities; PL-02a.04[02] a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities; PL-02a.05 PL-02a.05[01] a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system; PL-02a.05[02] a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system; PL-02a.06 PL-02a.06[01] a security plan for the system is developed that provides the security categorization of the system, including supporting rationale; PL-02a.06[02] a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale; PL-02a.07 PL-02a.07[01] a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization; PL-02a.07[02] a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization; PL-02a.08 PL-02a.08[01] a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information; PL-02a.08[02] a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information; PL-02a.09 PL-02a.09[01] a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components; PL-02a.09[02] a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components; PL-02a.10 PL-02a.10[01] a security plan for the system is developed that provides an overview of the security requirements for the system; PL-02a.10[02] a privacy plan for the system is developed that provides an overview of the privacy requirements for the system; PL-02a.11 PL-02a.11[01] a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable; PL-02a.11[02] a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable; PL-02a.12 PL-02a.12[01] a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions; PL-02a.12[02] a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions; PL-02a.13 PL-02a.13[01] a security plan for the system is developed that includes risk determinations for security architecture and design decisions; PL-02a.13[02] a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions; PL-02a.14 PL-02a.14[01] a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups]; PL-02a.14[02] a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups]; PL-02a.15 PL-02a.15[01] a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation; PL-02a.15[02] a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation. PL-02b. PL-02b.[01] copies of the plans are distributed to [Assignment: personnel or roles]; PL-02b.[02] subsequent changes to the plans are communicated to [Assignment: personnel or roles]; PL-02c. plans are reviewed [Assignment: frequency]; PL-02d. PL-02d.[01] plans are updated to address changes to the system and environment of operations; PL-02d.[02] plans are updated to address problems identified during the plan implementation; PL-02d.[03] plans are updated to address problems identified during control assessments; PL-02e. PL-02e.[01] plans are protected from unauthorized disclosure; PL-02e.[02] plans are protected from unauthorized modification. Assessment Methods Examine Security and privacy planning policy procedures addressing system security and privacy plan development and implementation procedures addressing security and privacy plan reviews and updates enterprise architecture documentation system security plan privacy plan records of system security and privacy plan reviews and updates security and privacy architecture and design documentation risk assessments risk assessment results control assessment documentation other relevant documents or records Interview Organizational personnel with system security and privacy planning and plan implementation responsibilities system developers organizational personnel with information security and privacy responsibilities Test Organizational processes for system security and privacy plan development, review, update, and approval mechanisms supporting the system security and privacy plan
PL-04 [M] Rules of Behavior – Assessment Procedure	Assessment Objective Determine if: PL-04a. PL-04a.[01] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system; PL-04a.[02] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system; PL-04b. before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received; PL-04c. rules of behavior are reviewed and updated [Assignment: frequency]; PL-04d. individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [Selection (one or more): [Assignment: frequency] ; when the rules are revised or updated]. Assessment Methods Examine Security and privacy planning policy procedures addressing rules of behavior for system users rules of behavior signed acknowledgements records for rules of behavior reviews and updates other relevant documents or records Interview Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior organizational personnel with responsibility for literacy training and awareness and role-based training organizational personnel who are authorized users of the system and have signed and resigned rules of behavior organizational personnel with information security and privacy responsibilities Test Organizational processes for establishing, reviewing, disseminating, and updating rules of behavior mechanisms supporting and/or implementing the establishment, review, dissemination, and update of rules of behavior
PL-04(01) [M] Social Media and External Site/Application Usage Restrictions – Assessment Procedure	Assessment Objective Determine if: PL-04(01)(a) the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications; PL-04(01)(b) the rules of behavior include restrictions on posting organizational information on public websites; PL-04(01)(c) the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications. Assessment Methods Examine Security and privacy planning policy procedures addressing rules of behavior for system users rules of behavior training policy other relevant documents or records Interview Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior organizational personnel with responsibility for literacy training and awareness and role-based training organizational personnel who are authorized users of the system and have signed rules of behavior organizational personnel with information security and privacy responsibilities Test Organizational processes for establishing rules of behavior mechanisms supporting and/or implementing the establishment of rules of behavior
PL-08 [M] Security and Privacy Architectures – Assessment Procedure	Assessment Objective Determine if: PL-08a. PL-08a.01 a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; PL-08a.02 a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; PL-08a.03 PL-08a.03[01] a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture; PL-08a.03[02] a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture; PL-08a.04 PL-08a.04[01] a security architecture for the system describes any assumptions about and dependencies on external systems and services; PL-08a.04[02] a privacy architecture for the system describes any assumptions about and dependencies on external systems and services; PL-08b. changes in the enterprise architecture are reviewed and updated [Assignment: frequency] to reflect changes in the enterprise architecture; PL-08c. PL-08c.[01] planned architecture changes are reflected in the security plan; PL-08c.[02] planned architecture changes are reflected in the privacy plan; PL-08c.[03] planned architecture changes are reflected in the Concept of Operations (CONOPS); PL-08c.[04] planned architecture changes are reflected in criticality analysis; PL-08c.[05] planned architecture changes are reflected in organizational procedures; PL-08c.[06] planned architecture changes are reflected in procurements and acquisitions. Assessment Methods Examine Security and privacy planning policy procedures addressing information security and privacy architecture development procedures addressing information security and privacy architecture reviews and updates enterprise architecture documentation information security and privacy architecture documentation system security plan privacy plan security and privacy CONOPS for the system records of information security and privacy architecture reviews and updates other relevant documents or records Interview Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy architecture development responsibilities organizational personnel with information security and privacy responsibilities Test Organizational processes for developing, reviewing, and updating the information security and privacy architecture mechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture
PL-10 [M] Baseline Selection – Assessment Procedure	Assessment Objective Determine if: PL-10 a control baseline for the system is selected. Assessment Methods Examine Security and privacy planning policy procedures addressing system security and privacy plan development and implementation procedures addressing system security and privacy plan reviews and updates system design documentation system architecture and configuration documentation system categorization decision information types stored, transmitted, and processed by the system system element/component information stakeholder needs analysis list of security and privacy requirements allocated to the system, system elements, and environment of operation list of contractual requirements allocated to external providers of the system or system element business impact analysis or criticality analysis risk assessments risk management strategy organizational security and privacy policy federal or organization-approved or mandated baselines or overlays system security plan privacy plan other relevant documents or records Interview Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with responsibility for organizational risk management activities
PL-11 [M] Baseline Tailoring – Assessment Procedure	Assessment Objective Determine if: PL-11 the selected control baseline is tailored by applying specified tailoring actions. Assessment Methods Examine Security and privacy planning policy procedures addressing system security and privacy plan development and implementation system design documentation system categorization decision information types stored, transmitted, and processed by the system system element/component information stakeholder needs analysis list of security and privacy requirements allocated to the system, system elements, and environment of operation list of contractual requirements allocated to external providers of the system or system element business impact analysis or criticality analysis risk assessments risk management strategy organizational security and privacy policy federal or organization-approved or mandated baselines or overlays baseline tailoring rationale system security plan privacy plan records of system security and privacy plan reviews and updates other relevant documents or records Interview Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy responsibilities
PS-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: PS-01a. PS-01a.[01] a personnel security policy is developed and documented; PS-01a.[02] the personnel security policy is disseminated to [Assignment: personnel or roles]; PS-01a.[03] personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented; PS-01a.[04] the personnel security procedures are disseminated to [Assignment: personnel or roles]; PS-01a.01 PS-01a.01(a) PS-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses purpose; PS-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses scope; PS-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses roles; PS-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses responsibilities; PS-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses management commitment; PS-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses coordination among organizational entities; PS-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy addresses compliance; PS-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; PS-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures; PS-01c. PS-01c.01 PS-01c.01[01] the current personnel security policy is reviewed and updated [Assignment: frequency]; PS-01c.01[02] the current personnel security policy is reviewed and updated following [Assignment: events]; PS-01c.02 PS-01c.02[01] the current personnel security procedures are reviewed and updated [Assignment: frequency]; PS-01c.02[02] the current personnel security procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Personnel security policy personnel security procedures system security plan privacy plan risk management strategy documentation audit findings other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-02 [M] Position Risk Designation – Assessment Procedure	Assessment Objective Determine if: PS-02a. a risk designation is assigned to all organizational positions; PS-02b. screening criteria are established for individuals filling organizational positions; PS-02c. position risk designations are reviewed and updated [Assignment: frequency]. Assessment Methods Examine Personnel security policy procedures addressing position categorization appropriate codes of federal regulations list of risk designations for organizational positions records of position risk designation reviews and updates system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities Test Organizational processes for assigning, reviewing, and updating position risk designations organizational processes for establishing screening criteria
PS-03 [M] Personnel Screening – Assessment Procedure	Assessment Objective Determine if: PS-03a. individuals are screened prior to authorizing access to the system; PS-03b. PS-03b.[01] individuals are rescreened in accordance with [Assignment: conditions requiring rescreening]; PS-03b.[02] where rescreening is so indicated, individuals are rescreened [Assignment: frequency]. Assessment Methods Examine Personnel security policy procedures addressing personnel screening records of screened personnel system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities Test Organizational processes for personnel screening
PS-04 [M] Personnel Termination – Assessment Procedure	Assessment Objective Determine if: PS-04a. upon termination of individual employment, system access is disabled within [Assignment: time period]; PS-04b. upon termination of individual employment, any authenticators and credentials are terminated or revoked; PS-04c. upon termination of individual employment, exit interviews that include a discussion of [Assignment: information security topics] are conducted; PS-04d. upon termination of individual employment, all security-related organizational system-related property is retrieved; PS-04e. upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained. Assessment Methods Examine Personnel security policy procedures addressing personnel termination records of personnel termination actions list of system accounts records of terminated or revoked authenticators/credentials records of exit interviews system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities Test Organizational processes for personnel termination mechanisms supporting and/or implementing personnel termination notifications mechanisms for disabling system access/revoking authenticators
PS-05 [M] Personnel Transfer – Assessment Procedure	Assessment Objective Determine if: PS-05a. the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization; PS-05b. [Assignment: transfer or reassignment actions] are initiated within [Assignment: time period following the formal transfer action]; PS-05c. access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer; PS-05d. [Assignment: personnel or roles] are notified within [Assignment: time period]. Assessment Methods Examine Personnel security policy procedures addressing personnel transfer records of personnel transfer actions list of system and facility access authorizations system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities Test Organizational processes for personnel transfer mechanisms supporting and/or implementing personnel transfer notifications mechanisms for disabling system access/revoking authenticators
PS-06 [M] Access Agreements – Assessment Procedure	Assessment Objective Determine if: PS-06a. access agreements are developed and documented for organizational systems; PS-06b. the access agreements are reviewed and updated [Assignment: frequency]; PS-06c. PS-06c.01 individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access; PS-06c.02 individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: frequency]. Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing access agreements for organizational information and systems access control policy access control procedures access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) documentation of access agreement reviews, updates, and re-signing system security plan privacy plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel who have signed/resigned access agreements organizational personnel with information security and privacy responsibilities Test Organizational processes for reviewing, updating, and re-signing access agreements mechanisms supporting the reviewing, updating, and re-signing of access agreements
PS-07 [M] External Personnel Security – Assessment Procedure	Assessment Objective Determine if: PS-07a. personnel security requirements are established, including security roles and responsibilities for external providers; PS-07b. external providers are required to comply with personnel security policies and procedures established by the organization; PS-07c. personnel security requirements are documented; PS-07d. external providers are required to notify [Assignment: personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [Assignment: time period]; PS-07e. provider compliance with personnel security requirements is monitored. Assessment Methods Examine Personnel security policy procedures addressing external personnel security list of personnel security requirements acquisition documents service-level agreements compliance monitoring process system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities external providers system/network administrators organizational personnel with account management responsibilities organizational personnel with information security responsibilities Test Organizational processes for managing and monitoring external personnel security mechanisms supporting and/or implementing the monitoring of provider compliance
PS-08 [M] Personnel Sanctions – Assessment Procedure	Assessment Objective Determine if: PS-08a. a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures; PS-08b. [Assignment: personnel or roles] is/are notified within [Assignment: time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction. Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing personnel sanctions access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) list of personnel or roles to be notified of formal employee sanctions records or notifications of formal employee sanctions system security plan privacy plan personally identifiable information processing policy other relevant documents or records Interview Organizational personnel with personnel security responsibilities legal counsel organizational personnel with information security and privacy responsibilities Test Organizational processes for managing formal employee sanctions mechanisms supporting and/or implementing formal employee sanctions notifications
PS-09 [M] Position Descriptions – Assessment Procedure	Assessment Objective Determine if: PS-09[01] security roles and responsibilities are incorporated into organizational position descriptions; PS-09[02] privacy roles and responsibilities are incorporated into organizational position descriptions. Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing position descriptions security and privacy position descriptions system security plan privacy plan privacy program plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with human capital management responsibilities Test Organizational processes for managing position descriptions
RA-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: RA-01a. RA-01a.[01] a risk assessment policy is developed and documented; RA-01a.[02] the risk assessment policy is disseminated to [Assignment: personnel or roles]; RA-01a.[03] risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented; RA-01a.[04] the risk assessment procedures are disseminated to [Assignment: personnel or roles]; RA-01a.01 RA-01a.01(a) RA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses purpose; RA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses scope; RA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses roles; RA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses responsibilities; RA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses management commitment; RA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses coordination among organizational entities; RA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses compliance; RA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; RA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures; RA-01c. RA-01c.01 RA-01c.01[01] the current risk assessment policy is reviewed and updated [Assignment: frequency]; RA-01c.01[02] the current risk assessment policy is reviewed and updated following [Assignment: events]; RA-01c.02 RA-01c.02[01] the current risk assessment procedures are reviewed and updated [Assignment: frequency]; RA-01c.02[02] the current risk assessment procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Risk assessment policy and procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-02 [M] Security Categorization – Assessment Procedure	Assessment Objective Determine if: RA-02a. the system and the information it processes, stores, and transmits are categorized; RA-02b. the security categorization results, including supporting rationale, are documented in the security plan for the system; RA-02c. the authorizing official or authorizing official designated representative reviews and approves the security categorization decision. Assessment Methods Examine Risk assessment policy security planning policy and procedures procedures addressing security categorization of organizational information and systems security categorization documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with security categorization and risk assessment responsibilities organizational personnel with security and privacy responsibilities Test Organizational processes for security categorization
RA-03 [M] Risk Assessment – Assessment Procedure	Assessment Objective Determine if: RA-03a. RA-03a.01 a risk assessment is conducted to identify threats to and vulnerabilities in the system; RA-03a.02 a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information; RA-03a.03 a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; RA-03b. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments; RA-03c. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; [Assignment: document] ]; RA-03d. risk assessment results are reviewed [Assignment: frequency]; RA-03e. risk assessment results are disseminated to [Assignment: personnel or roles]; RA-03f. the risk assessment is updated [Assignment: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system. Assessment Methods Examine Risk assessment policy risk assessment procedures security and privacy planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates system security plan privacy plan other relevant documents or records Interview Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities Test Organizational processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
RA-03(01) [M] Supply Chain Risk Assessment – Assessment Procedure	Assessment Objective Determine if: RA-03(01)(a) supply chain risks associated with [Assignment: systems, system components, and system services] are assessed; RA-03(01)(b) the supply chain risk assessment is updated [Assignment: frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain. Assessment Methods Examine Supply chain risk management policy inventory of critical systems, system components, and system services risk assessment policy security planning policy and procedures procedures addressing organizational assessments of supply chain risk risk assessment risk assessment results risk assessment reviews risk assessment updates acquisition policy system security plan supply chain risk management plan other relevant documents or records Interview Organizational personnel with risk assessment responsibilities organizational personnel with security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the supply chain risk assessment
RA-05 [M] Vulnerability Monitoring and Scanning – Assessment Procedure	Assessment Objective Determine if: RA-05a. RA-05a.[01] systems and hosted applications are monitored for vulnerabilities [Assignment: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; RA-05a.[02] systems and hosted applications are scanned for vulnerabilities [Assignment: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; RA-05b. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools; RA-05b.01 vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations; RA-05b.02 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures; RA-05b.03 vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact; RA-05c. vulnerability scan reports and results from vulnerability monitoring are analyzed; RA-05d. legitimate vulnerabilities are remediated [Assignment: response times] in accordance with an organizational assessment of risk; RA-05e. information obtained from the vulnerability monitoring process and control assessments is shared with [Assignment: personnel or roles] to help eliminate similar vulnerabilities in other systems; RA-05f. vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed. Assessment Methods Examine Risk assessment policy procedures addressing vulnerability scanning risk assessment assessment report vulnerability scanning tools and associated configuration documentation vulnerability scanning results patch and vulnerability management records system security plan other relevant documents or records Interview Organizational personnel with risk assessment, control assessment, and vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with vulnerability remediation responsibilities organizational personnel with security responsibilities system/network administrators Test Organizational processes for vulnerability scanning, analysis, remediation, and information sharing mechanisms supporting and/or implementing vulnerability scanning, analysis, remediation, and information sharing
RA-05(02) [M] Update Vulnerabilities to Be Scanned – Assessment Procedure	Assessment Objective Determine if: RA-05(02) the system vulnerabilities to be scanned are updated [Selection (one or more): [Assignment: frequency] ; prior to a new scan; when new vulnerabilities are identified and reported]. Assessment Methods Examine Procedures addressing vulnerability scanning assessment report vulnerability scanning tools and associated configuration documentation vulnerability scanning results patch and vulnerability management records system security plan other relevant documents or records Interview Organizational personnel with vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with security responsibilities system/network administrators Test Organizational processes for vulnerability scanning mechanisms/tools supporting and/or implementing vulnerability scanning
RA-05(05) [M] Privileged Access – Assessment Procedure	Assessment Objective Determine if: RA-05(05) privileged access authorization is implemented to [Assignment: system components] for [Assignment: vulnerability scanning activities]. Assessment Methods Examine Risk assessment policy procedures addressing vulnerability scanning system design documentation system configuration settings and associated documentation list of system components for vulnerability scanning personnel access authorization list authorization credentials access authorization records system security plan other relevant documents or records Interview Organizational personnel with vulnerability scanning responsibilities system/network administrators organizational personnel responsible for access control to the system organizational personnel responsible for configuration management of the system system developers organizational personnel with security responsibilities Test Organizational processes for vulnerability scanning organizational processes for access control mechanisms supporting and/or implementing access control mechanisms/tools supporting and/or implementing vulnerability scanning
RA-05(11) [M] Public Disclosure Program – Assessment Procedure	Assessment Objective Determine if: RA-05(11) a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components. Assessment Methods Examine Risk assessment policy procedures addressing vulnerability scanning risk assessment vulnerability scanning tools and techniques documentation vulnerability scanning results vulnerability management records audit records public reporting channel system security plan other relevant documents or records Interview Organizational personnel with vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with security responsibilities Test Organizational processes for vulnerability scanning mechanisms/tools supporting and/or implementing vulnerability scanning mechanisms implementing the public reporting of vulnerabilities
RA-07 [M] Risk Response – Assessment Procedure	Assessment Objective Determine if: RA-07[01] findings from security assessments are responded to in accordance with organizational risk tolerance; RA-07[02] findings from privacy assessments are responded to in accordance with organizational risk tolerance; RA-07[03] findings from monitoring are responded to in accordance with organizational risk tolerance; RA-07[04] findings from audits are responded to in accordance with organizational risk tolerance. Assessment Methods Examine Risk assessment policy assessment reports audit records/event logs system security plan privacy plan other relevant documents or records Interview Organizational personnel with assessment and auditing responsibilities system/network administrators organizational personnel with security and privacy responsibilities Test Organizational processes for assessments and audits mechanisms/tools supporting and/or implementing assessments and auditing
RA-09 [M] Criticality Analysis – Assessment Procedure	Assessment Objective Determine if: RA-09 critical system components and functions are identified by performing a criticality analysis for [Assignment: systems, system components, or system services] at [Assignment: decision points in the system development life cycle]. Assessment Methods Examine Risk assessment policy assessment reports criticality analysis/finalized criticality for each component/subcomponent audit records/event logs analysis reports system security plan other relevant documents or records Interview Organizational personnel with assessment and auditing responsibilities organizational personnel with criticality analysis responsibilities system/network administrators organizational personnel with security responsibilities Test Organizational processes for assessments and audits mechanisms/tools supporting and/or implementing assessments and auditing
SA-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SA-01a. SA-01a.[01] a system and services acquisition policy is developed and documented; SA-01a.[02] the system and services acquisition policy is disseminated to [Assignment: personnel or roles]; SA-01a.[03] system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented; SA-01a.[04] the system and services acquisition procedures are disseminated to [Assignment: personnel or roles]; SA-01a.01 SA-01a.01(a) SA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses purpose; SA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses scope; SA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses roles; SA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses responsibilities; SA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses management commitment; SA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses coordination among organizational entities; SA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses compliance; SA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures; SA-01c. SA-01c.01 SA-01c.01[01] the system and services acquisition policy is reviewed and updated [Assignment: frequency]; SA-01c.01[02] the current system and services acquisition policy is reviewed and updated following [Assignment: events]; SA-01c.02 SA-01c.02[01] the current system and services acquisition procedures are reviewed and updated [Assignment: frequency]; SA-01c.02[02] the current system and services acquisition procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures supply chain risk management policy supply chain risk management procedures supply chain risk management plan system security plan privacy plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SA-02 [M] Allocation of Resources – Assessment Procedure	Assessment Objective Determine if: SA-02a. SA-02a.[01] the high-level information security requirements for the system or system service are determined in mission and business process planning; SA-02a.[02] the high-level privacy requirements for the system or system service are determined in mission and business process planning; SA-02b. SA-02b.[01] the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process; SA-02b.[02] the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process; SA-02c. SA-02c.[01] a discrete line item for information security is established in organizational programming and budgeting documentation; SA-02c.[02] a discrete line item for privacy is established in organizational programming and budgeting documentation. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures system and services acquisition strategy and plans procedures addressing the allocation of resources to information security and privacy requirements procedures addressing capital planning and investment control organizational programming and budgeting documentation system security plan privacy plan supply chain risk management policy other relevant documents or records Interview Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for determining information security and privacy requirements organizational processes for capital planning, programming, and budgeting mechanisms supporting and/or implementing organizational capital planning, programming, and budgeting
SA-03 [M] System Development Life Cycle – Assessment Procedure	Assessment Objective Determine if: SA-03a. SA-03a.[01] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates information security considerations; SA-03a.[02] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates privacy considerations; SA-03b. SA-03b.[01] information security roles and responsibilities are defined and documented throughout the system development life cycle; SA-03b.[02] privacy roles and responsibilities are defined and documented throughout the system development life cycle; SA-03c. SA-03c.[01] individuals with information security roles and responsibilities are identified; SA-03c.[02] individuals with privacy roles and responsibilities are identified; SA-03d. SA-03d.[01] organizational information security risk management processes are integrated into system development life cycle activities; SA-03d.[02] organizational privacy risk management processes are integrated into system development life cycle activities. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process system development life cycle documentation organizational risk management strategy information security and privacy risk management strategy documentation system security plan privacy plan privacy program plan enterprise architecture documentation role-based security and privacy training program documentation data mapping documentation other relevant documents or records Interview Organizational personnel with information security and privacy responsibilities organizational personnel with system life cycle development responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for defining and documenting the system development life cycle organizational processes for identifying system development life cycle roles and responsibilities organizational processes for integrating information security and privacy and supply chain risk management into the system development life cycle mechanisms supporting and/or implementing the system development life cycle
SA-04 [M] Acquisition Process – Assessment Procedure	Assessment Objective Determine if: SA-04a. SA-04a.[01] security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04a.[02] privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04b. strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04c. SA-04c.[01] security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04c.[02] privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04d. SA-04d.[01] controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04d.[02] controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04e. SA-04e.[01] security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04e.[02] privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04f. SA-04f.[01] requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04f.[02] requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04g. the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04h. SA-04h.[01] the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service; SA-04h.[02] the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ]; SA-04h.[03] the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ]; SA-04i. acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process configuration management plan acquisition contracts for the system, system component, or system service system design documentation system security plan supply chain risk management plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities system/network administrators organizational personnel with supply chain risk management responsibilities Test Organizational processes for determining system security and privacy functional, strength, and assurance requirements organizational processes for developing acquisition contracts mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
SA-04(01) [M] Functional Properties of Controls – Assessment Procedure	Assessment Objective Determine if: SA-04(01) the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing the integration of security and privacy requirements, descriptions, and criteria into the acquisition process solicitation documents acquisition documentation acquisition contracts for the system, system component, or system services system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities system developers Test Organizational processes for determining system security functional requirements organizational processes for developing acquisition contracts mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts
SA-04(02) [M] Design and Implementation Information for Controls – Assessment Procedure	Assessment Objective Determine if: SA-04(02) the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: design and implementation information] ] at [Assignment: level of detail]. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process solicitation documents acquisition documentation acquisition contracts for the system, system components, or system services design and implementation information for controls employed in the system, system component, or system service system security plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility to determine system security requirements system developers or service provider organizational personnel with information security responsibilities Test Organizational processes for determining the level of detail for system design and controls organizational processes for developing acquisition contracts mechanisms supporting and/or implementing the development of system design details
SA-04(09) [M] Functions, Ports, Protocols, and Services in Use – Assessment Procedure	Assessment Objective Determine if: SA-04(09)[01] the developer of the system, system component, or system service is required to identify the functions intended for organizational use; SA-04(09)[02] the developer of the system, system component, or system service is required to identify the ports intended for organizational use; SA-04(09)[03] the developer of the system, system component, or system service is required to identify the protocols intended for organizational use; SA-04(09)[04] the developer of the system, system component, or system service is required to identify the services intended for organizational use. Assessment Methods Examine System and services acquisition policy procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process system design documentation system documentation, including functions, ports, protocols, and services intended for organizational use acquisition contracts for systems or services acquisition documentation solicitation documentation service level agreements organizational security requirements, descriptions, and criteria for developers of systems, system components, and system services system security plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility for determining system security requirements system/network administrators organizational personnel operating, using, and/or maintaining the system system developers organizational personnel with information security responsibilities
SA-04(10) [M] Use of Approved PIV Products – Assessment Procedure	Assessment Objective Determine if: SA-04(10) only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed. Assessment Methods Examine Supply chain risk management plan system and services acquisition policy procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process solicitation documentation acquisition documentation acquisition contracts for the system, system component, or system service service level agreements FIPS 201 approved products list system security plan other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility for determining system security requirements organizational personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented organizational personnel with information security responsibilities Test Organizational processes for selecting and employing FIPS 201-approved products
SA-05 [M] System Documentation – Assessment Procedure	Assessment Objective Determine if: SA-05a. SA-05a.01 SA-05a.01[01] administrator documentation for the system, system component, or system service that describes the secure configuration of the system, component, or service is obtained or developed; SA-05a.01[02] administrator documentation for the system, system component, or system service that describes the secure installation of the system, component, or service is obtained or developed; SA-05a.01[03] administrator documentation for the system, system component, or system service that describes the secure operation of the system, component, or service is obtained or developed; SA-05a.02 SA-05a.02[01] administrator documentation for the system, system component, or system service that describes the effective use of security functions and mechanisms is obtained or developed; SA-05a.02[02] administrator documentation for the system, system component, or system service that describes the effective maintenance of security functions and mechanisms is obtained or developed; SA-05a.02[03] administrator documentation for the system, system component, or system service that describes the effective use of privacy functions and mechanisms is obtained or developed; SA-05a.02[04] administrator documentation for the system, system component, or system service that describes the effective maintenance of privacy functions and mechanisms is obtained or developed; SA-05a.03 SA-05a.03[01] administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the configuration of administrative or privileged functions is obtained or developed; SA-05a.03[02] administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the use of administrative or privileged functions is obtained or developed; SA-05b. SA-05b.01 SA-05b.01[01] user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms is obtained or developed; SA-05b.01[02] user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible security) functions and mechanisms is obtained or developed; SA-05b.01[03] user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms is obtained or developed; SA-05b.01[04] user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible privacy) functions and mechanisms is obtained or developed; SA-05b.02 SA-05b.02[01] user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner is obtained or developed; SA-05b.02[02] user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service to protect individual privacy is obtained or developed; SA-05b.03 SA-05b.03[01] user documentation for the system, system component, or system service that describes user responsibilities for maintaining the security of the system, component, or service is obtained or developed; SA-05b.03[02] user documentation for the system, system component, or system service that describes user responsibilities for maintaining the privacy of individuals is obtained or developed; SA-05c. SA-05c.[01] attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented; SA-05c.[02] after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, [Assignment: actions] are taken in response; SA-05d. documentation is distributed to [Assignment: personnel or roles]. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing system documentation system documentation, including administrator and user guides system design documentation records documenting attempts to obtain unavailable or nonexistent system documentation list of actions to be taken in response to documented attempts to obtain system, system component, or system service documentation risk management strategy documentation system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities system administrators organizational personnel responsible for operating, using, and/or maintaining the system system developers Test Organizational processes for obtaining, protecting, and distributing system administrator and user documentation
SA-08 [M] Security and Privacy Engineering Principles – Assessment Procedure	Assessment Objective Determine if: SA-08[01] [Assignment: systems security engineering principles] are applied in the specification of the system and system components; SA-08[02] [Assignment: systems security engineering principles] are applied in the design of the system and system components; SA-08[03] [Assignment: systems security engineering principles] are applied in the development of the system and system components; SA-08[04] [Assignment: systems security engineering principles] are applied in the implementation of the system and system components; SA-08[05] [Assignment: systems security engineering principles] are applied in the modification of the system and system components; SA-08[06] [Assignment: privacy engineering principles] are applied in the specification of the system and system components; SA-08[07] [Assignment: privacy engineering principles] are applied in the design of the system and system components; SA-08[08] [Assignment: privacy engineering principles] are applied in the development of the system and system components; SA-08[09] [Assignment: privacy engineering principles] are applied in the implementation of the system and system components; SA-08[10] [Assignment: privacy engineering principles] are applied in the modification of the system and system components. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures assessment and authorization procedures procedures addressing security and privacy engineering principles used in the specification, design, development, implementation, and modification of the system system design documentation security and privacy requirements and specifications for the system system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with acquisition/contracting responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with system specification, design, development, implementation, and modification responsibilities system developers Test Organizational processes for applying security and privacy engineering principles in system specification, design, development, implementation, and modification mechanisms supporting the application of security and privacy engineering principles in system specification, design, development, implementation, and modification
SA-09 [M] External System Services – Assessment Procedure	Assessment Objective Determine if: SA-09a. SA-09a.[01] providers of external system services comply with organizational security requirements; SA-09a.[02] providers of external system services comply with organizational privacy requirements; SA-09a.[03] providers of external system services employ [Assignment: controls]; SA-09b. SA-09b.[01] organizational oversight with regard to external system services are defined and documented; SA-09b.[02] user roles and responsibilities with regard to external system services are defined and documented; SA-09c. [Assignment: processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing methods and techniques for monitoring control compliance by external service providers of system services acquisition documentation contracts service level agreements interagency agreements licensing agreements list of organizational security and privacy requirements for external provider services control assessment results or reports from external providers of system services system security plan privacy plan supply chain risk management plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities external providers of system services organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis
SA-09(02) [M] Identification of Functions, Ports, Protocols, and Services – Assessment Procedure	Assessment Objective Determine if: SA-09(02) providers of [Assignment: external system services] are required to identify the functions, ports, protocols, and other services required for the use of such services. Assessment Methods Examine System and services acquisition policy supply chain risk management policy and procedures procedures addressing external system services acquisition contracts for the system, system component, or system service acquisition documentation solicitation documentation service level agreements organizational security requirements and security specifications for external service providers list of required functions, ports, protocols, and other services system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities system/network administrators external providers of system services
SA-10 [M] Developer Configuration Management – Assessment Procedure	Assessment Objective Determine if: SA-10a. the developer of the system, system component, or system service is required to perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal]; SA-10b. SA-10b.[01] the developer of the system, system component, or system service is required to document the integrity of changes to [Assignment: configuration items]; SA-10b.[02] the developer of the system, system component, or system service is required to manage the integrity of changes to [Assignment: configuration items]; SA-10b.[03] the developer of the system, system component, or system service is required to control the integrity of changes to [Assignment: configuration items]; SA-10c. the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service; SA-10d. SA-10d.[01] the developer of the system, system component, or system service is required to document approved changes to the system, component, or service; SA-10d.[02] the developer of the system, system component, or system service is required to document the potential security impacts of approved changes; SA-10d.[03] the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes; SA-10e. SA-10e.[01] the developer of the system, system component, or system service is required to track security flaws within the system, component, or service; SA-10e.[02] the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service; SA-10e.[03] the developer of the system, system component, or system service is required to report findings to [Assignment: personnel]. Assessment Methods Examine System and services acquisition policy procedures addressing system developer configuration management solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service system developer configuration management plan security flaw and flaw resolution tracking records system change authorization records change control records configuration management records system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with configuration management responsibilities system developers Test Organizational processes for monitoring developer configuration management mechanisms supporting and/or implementing the monitoring of developer configuration management
SA-11 [M] Developer Testing and Evaluation – Assessment Procedure	Assessment Objective Determine if: SA-11a. SA-11a.[01] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments; SA-11a.[02] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments; SA-11a.[03] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments; SA-11a.[04] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments; SA-11b. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [Selection (one or more): unit; integration; system; regression] testing/evaluation [Assignment: frequency to conduct] at [Assignment: depth and coverage]; SA-11c. SA-11c.[01] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan; SA-11c.[02] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation; SA-11d. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process; SA-11e. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing system developer security and privacy testing procedures addressing flaw remediation solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service security and privacy architecture system design documentation system developer security and privacy assessment plans results of developer security and privacy assessments for the system, system component, or system service security and privacy flaw and remediation tracking records system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with developer security and privacy testing responsibilities system developers Test Organizational processes for monitoring developer security testing and evaluation mechanisms supporting and/or implementing the monitoring of developer security and privacy testing and evaluation
SA-15 [M] Development Process, Standards, and Tools – Assessment Procedure	Assessment Objective Determine if: SA-15a. SA-15a.01 SA-15a.01[01] the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements; SA-15a.01[02] the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements; SA-15a.02 SA-15a.02[01] the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process; SA-15a.02[02] the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process; SA-15a.03 SA-15a.03[01] the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process; SA-15a.03[02] the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process; SA-15a.04 the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development; SA-15b. SA-15b.[01] the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignment: frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignment: security requirements]; SA-15b.[02] the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [Assignment: frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [Assignment: privacy requirements]. Assessment Methods Examine System and services acquisition policy system and services acquisition procedures procedures addressing development process, standards, and tools procedures addressing the integration of security and privacy requirements during the development process solicitation documentation acquisition documentation critical component inventory documentation service level agreements acquisition contracts for the system, system component, or system service system developer documentation listing tool options/configuration guides configuration management policy configuration management records documentation of development process reviews using maturity models change control records configuration control records documented reviews of the development process, standards, tools, and tool options/configurations system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities system developer
SA-15(03) [M] Criticality Analysis – Assessment Procedure	Assessment Objective Determine if: SA-15(03)(a) the developer of the system, system component, or system service is required to perform a criticality analysis at [Assignment: decision points] in the system development life cycle; SA-15(03)(b) SA-15(03)(b)[01] the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignment: breadth]; SA-15(03)(b)[02] the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [Assignment: depth] . Assessment Methods Examine Supply chain risk management plan system and services acquisition policy procedures addressing development process, standards, and tools procedures addressing criticality analysis requirements for the system, system component, or system service solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service criticality analysis documentation business impact analysis documentation software development life cycle documentation system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel responsible for performing criticality analysis system developer organizational personnel with supply chain risk management responsibilities Test Organizational processes for performing criticality analysis mechanisms supporting and/or implementing criticality analysis
SA-22 [M] Unsupported System Components – Assessment Procedure	Assessment Objective Determine if: SA-22a. system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer; SA-22b. [Selection (one or more): in-house support; [Assignment: support from external providers] ] provide options for alternative sources for continued support for unsupported components. Assessment Methods Examine System and services acquisition policy procedures addressing the replacement or continued use of unsupported system components documented evidence of replacing unsupported system components documented approvals (including justification) for the continued use of unsupported system components system security plan supply chain risk management plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with the responsibility for the system development life cycle organizational personnel responsible for component replacement Test Organizational processes for replacing unsupported system components mechanisms supporting and/or implementing the replacement of unsupported system components
SC-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SC-01a. SC-01a.[01] a system and communications protection policy is developed and documented; SC-01a.[02] the system and communications protection policy is disseminated to [Assignment: personnel or roles]; SC-01a.[03] system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented; SC-01a.[04] the system and communications protection procedures are disseminated to [Assignment: personnel or roles]; SC-01a.01 SC-01a.01(a) SC-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses purpose; SC-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses scope; SC-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses roles; SC-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses responsibilities; SC-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses management commitment; SC-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses coordination among organizational entities; SC-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy addresses compliance; SC-01a.01(b) the [Selection (one or more): organization-level; mission/business-process-level; system-level] system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SC-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; SC-01c. SC-01c.01 SC-01c.01[01] the current system and communications protection policy is reviewed and updated [Assignment: frequency]; SC-01c.01[02] the current system and communications protection policy is reviewed and updated following [Assignment: events]; SC-01c.02 SC-01c.02[01] the current system and communications protection procedures are reviewed and updated [Assignment: frequency]; SC-01c.02[02] the current system and communications protection procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System and communications protection policy system and communications protection procedures system security plan privacy plan risk management strategy documentation audit findings other relevant documents or records Interview Organizational personnel with system and communications protection responsibilities organizational personnel with information security and privacy responsibilities
SC-02 [M] Separation of System and User Functionality – Assessment Procedure	Assessment Objective Determine if: SC-02 user functionality, including user interface services, is separated from system management functionality. Assessment Methods Examine System and communications protection policy procedures addressing application partitioning system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Separation of user functionality from system management functionality
SC-04 [M] Information in Shared System Resources – Assessment Procedure	Assessment Objective Determine if: SC-04[01] unauthorized information transfer via shared system resources is prevented; SC-04[02] unintended information transfer via shared system resources is prevented. Assessment Methods Examine System and communications protection policy procedures addressing information protection in shared system resources system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Mechanisms preventing the unauthorized and unintended transfer of information via shared system resources
SC-05 [M] Denial-of-service Protection – Assessment Procedure	Assessment Objective Determine if: SC-05a. the effects of [Assignment: types of denial-of-service events] are [Selection: protect against; limit]; SC-05b. [Assignment: controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective. Assessment Methods Examine System and communications protection policy procedures addressing denial-of-service protection system design documentation list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks list of security safeguards protecting against or limiting the effects of denial-of-service attacks system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with incident response responsibilities system developer Test Mechanisms protecting against or limiting the effects of denial-of-service attacks
SC-07 [M] Boundary Protection – Assessment Procedure	Assessment Objective Determine if: SC-07a. SC-07a.[01] communications at external managed interfaces to the system are monitored; SC-07a.[02] communications at external managed interfaces to the system are controlled; SC-07a.[03] communications at key internal managed interfaces within the system are monitored; SC-07a.[04] communications at key internal managed interfaces within the system are controlled; SC-07b. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks; SC-07c. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection list of key internal boundaries of the system system design documentation boundary protection hardware and software system configuration settings and associated documentation enterprise security architecture documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities Test Mechanisms implementing boundary protection capabilities
SC-07(03) [M] Access Points – Assessment Procedure	Assessment Objective Determine if: SC-07(03) the number of external network connections to the system is limited. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation boundary protection hardware and software system architecture and configuration documentation system configuration settings and associated documentation communications and network traffic monitoring logs system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities Test Mechanisms implementing boundary protection capabilities mechanisms limiting the number of external network connections to the system
SC-07(04) [M] External Telecommunications Services – Assessment Procedure	Assessment Objective Determine if: SC-07(04)(a) a managed interface is implemented for each external telecommunication service; SC-07(04)(b) a traffic flow policy is established for each managed interface; SC-07(04)(c) SC-07(04)(c)[01] the confidentiality of the information being transmitted across each interface is protected; SC-07(04)(c)[02] the integrity of the information being transmitted across each interface is protected; SC-07(04)(d) each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need; SC-07(04)(e) SC-07(04)(e)[01] exceptions to the traffic flow policy are reviewed [Assignment: frequency]; SC-07(04)(e)[02] exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed; SC-07(04)(f) unauthorized exchanges of control plan traffic with external networks are prevented; SC-07(04)(g) information is published to enable remote networks to detect unauthorized control plane traffic from internal networks; SC-07(04)(h) unauthorized control plane traffic is filtered from external networks. Assessment Methods Examine System and communications protection policy traffic flow policy information flow control policy procedures addressing boundary protection system security architecture system design documentation boundary protection hardware and software system architecture and configuration documentation system configuration settings and associated documentation records of traffic flow policy exceptions system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities Test Organizational processes for documenting and reviewing exceptions to the traffic flow policy organizational processes for removing exceptions to the traffic flow policy mechanisms implementing boundary protection capabilities managed interfaces implementing traffic flow policy
SC-07(05) [M] Deny by Default — Allow by Exception – Assessment Procedure	Assessment Objective Determine if: SC-07(05)[01] network communications traffic is denied by default [Selection (one or more): at managed interfaces; for [Assignment: systems] ]; SC-07(05)[02] network communications traffic is allowed by exception [Selection (one or more): at managed interfaces; for [Assignment: systems] ]. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities Test Mechanisms implementing traffic management at managed interfaces
SC-07(07) [M] Split Tunneling for Remote Devices – Assessment Procedure	Assessment Objective Determine if: SC-07(07) split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: safeguards]. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities Test Mechanisms implementing boundary protection capabilities mechanisms supporting/restricting non-remote connections
SC-07(08) [M] Route Traffic to Authenticated Proxy Servers – Assessment Procedure	Assessment Objective Determine if: SC-07(08) [Assignment: internal communications traffic] is routed to [Assignment: external networks] through authenticated proxy servers at managed interfaces. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities Test Mechanisms implementing traffic management through authenticated proxy servers at managed interfaces
SC-08 [M] Transmission Confidentiality and Integrity – Assessment Procedure	Assessment Objective Determine if: SC-08 the [Selection (one or more): confidentiality; integrity] of transmitted information is/are protected. Assessment Methods Examine System and communications protection policy procedures addressing transmission confidentiality and integrity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Mechanisms supporting and/or implementing transmission confidentiality and/or integrity
SC-08(01) [M] Cryptographic Protection – Assessment Procedure	Assessment Objective Determine if: SC-08(01) cryptographic mechanisms are implemented to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission. Assessment Methods Examine System and communications protection policy procedures addressing transmission confidentiality and integrity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Cryptographic mechanisms supporting and/or implementing transmission confidentiality and/or integrity mechanisms supporting and/or implementing alternative physical safeguards organizational processes for defining and implementing alternative physical safeguards
SC-10 [M] Network Disconnect – Assessment Procedure	Assessment Objective Determine if: SC-10 the network connection associated with a communication session is terminated at the end of the session or after [Assignment: time period] of inactivity. Assessment Methods Examine System and communications protection policy procedures addressing network disconnect system design documentation security plan system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Mechanisms supporting and/or implementing a network disconnect capability
SC-12 [M] Cryptographic Key Establishment and Management – Assessment Procedure	Assessment Objective Determine if: SC-12[01] cryptographic keys are established when cryptography is employed within the system in accordance with [Assignment: requirements]; SC-12[02] cryptographic keys are managed when cryptography is employed within the system in accordance with [Assignment: requirements]. Assessment Methods Examine System and communications protection policy procedures addressing cryptographic key establishment and management system design documentation cryptographic mechanisms system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for cryptographic key establishment and/or management Test Mechanisms supporting and/or implementing cryptographic key establishment and management
SC-13 [M] Cryptographic Protection – Assessment Procedure	Assessment Objective Determine if: SC-13a. [Assignment: cryptographic uses] are identified; SC-13b. [Assignment: types of cryptography] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented. Assessment Methods Examine System and communications protection policy procedures addressing cryptographic protection system design documentation system configuration settings and associated documentation cryptographic module validation certificates list of FIPS-validated cryptographic modules system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with responsibilities for cryptographic protection Test Mechanisms supporting and/or implementing cryptographic protection
SC-15 [M] Collaborative Computing Devices and Applications – Assessment Procedure	Assessment Objective Determine if: SC-15a. remote activation of collaborative computing devices and applications is prohibited except [Assignment: exceptions where remote activation is to be allowed]; SC-15b. an explicit indication of use is provided to users physically present at the devices. Assessment Methods Examine System and communications protection policy procedures addressing collaborative computing access control policy and procedures system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with responsibilities for managing collaborative computing devices Test Mechanisms supporting and/or implementing the management of remote activation of collaborative computing devices mechanisms providing an indication of use of collaborative computing devices
SC-17 [M] Public Key Infrastructure Certificates – Assessment Procedure	Assessment Objective Determine if: SC-17a. public key certificates are issued under [Assignment: certificate policy] , or public key certificates are obtained from an approved service provider; SC-17b. only approved trust anchors are included in trust stores or certificate stores managed by the organization. Assessment Methods Examine System and communications protection policy procedures addressing public key infrastructure certificates public key certificate policy or policies public key issuing process system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for issuing public key certificates service providers Test Mechanisms supporting and/or implementing the management of public key infrastructure certificates
SC-18 [M] Mobile Code – Assessment Procedure	Assessment Objective Determine if: SC-18a. SC-18a.[01] acceptable mobile code is defined; SC-18a.[02] unacceptable mobile code is defined; SC-18a.[03] acceptable mobile code technologies are defined; SC-18a.[04] unacceptable mobile code technologies are defined; SC-18b. SC-18b.[01] the use of mobile code is authorized within the system; SC-18b.[02] the use of mobile code is monitored within the system; SC-18b.[03] the use of mobile code is controlled within the system. Assessment Methods Examine System and communications protection policy procedures addressing mobile code mobile code implementation policy and procedures list of acceptable mobile code and mobile code technologies list of unacceptable mobile code and mobile technologies authorization records system monitoring records system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing mobile code Test Organizational process for authorizing, monitoring, and controlling mobile code mechanisms supporting and/or implementing the management of mobile code mechanisms supporting and/or implementing the monitoring of mobile code
SC-20 [M] Secure Name/Address Resolution Service (Authoritative Source) – Assessment Procedure	Assessment Objective Determine if: SC-20a. SC-20a.[01] additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries; SC-20a.[02] integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries; SC-20b. SC-20b.[01] the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace; SC-20b.[02] the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided. Assessment Methods Examine System and communications protection policy procedures addressing secure name/address resolution services (authoritative source) system design documentation system configuration settings and associated documentation system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing DNS Test Mechanisms supporting and/or implementing secure name/address resolution services
SC-21 [M] Secure Name/Address Resolution Service (Recursive or Caching Resolver) – Assessment Procedure	Assessment Objective Determine if: SC-21[01] data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources; SC-21[02] data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources; SC-21[03] data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources; SC-21[04] data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources. Assessment Methods Examine System and communications protection policy procedures addressing secure name/address resolution services (recursive or caching resolver) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing DNS Test Mechanisms supporting and/or implementing data origin authentication and data integrity verification for name/address resolution services
SC-22 [M] Architecture and Provisioning for Name/Address Resolution Service – Assessment Procedure	Assessment Objective Determine if: SC-22[01] the systems that collectively provide name/address resolution services for an organization are fault-tolerant; SC-22[02] the systems that collectively provide name/address resolution services for an organization implement internal role separation; SC-22[03] the systems that collectively provide name/address resolution services for an organization implement external role separation. Assessment Methods Examine System and communications protection policy procedures addressing architecture and provisioning for name/address resolution services access control policy and procedures system design documentation assessment results from independent testing organizations system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel with responsibilities for managing DNS Test Mechanisms supporting and/or implementing name/address resolution services for fault tolerance and role separation
SC-23 [M] Session Authenticity – Assessment Procedure	Assessment Objective Determine if: SC-23 the authenticity of communication sessions is protected. Assessment Methods Examine System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities Test Mechanisms supporting and/or implementing session authenticity
SC-28 [M] Protection of Information at Rest – Assessment Procedure	Assessment Objective Determine if: SC-28 the [Selection (one or more): confidentiality; integrity] of [Assignment: information at rest] is/are protected. Assessment Methods Examine System and communications protection policy procedures addressing the protection of information at rest system design documentation system configuration settings and associated documentation cryptographic mechanisms and associated configuration documentation list of information at rest requiring confidentiality and integrity protections system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Mechanisms supporting and/or implementing confidentiality and integrity protections for information at rest
SC-28(01) [M] Cryptographic Protection – Assessment Procedure	Assessment Objective Determine if: SC-28(01)[01] cryptographic mechanisms are implemented to prevent unauthorized disclosure of [Assignment: information] at rest on [Assignment: system components or media]; SC-28(01)[02] cryptographic mechanisms are implemented to prevent unauthorized modification of [Assignment: information] at rest on [Assignment: system components or media]. Assessment Methods Examine System and communications protection policy procedures addressing the protection of information at rest system design documentation system configuration settings and associated documentation cryptographic mechanisms and associated configuration documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer Test Cryptographic mechanisms implementing confidentiality and integrity protections for information at rest
SC-39 [M] Process Isolation – Assessment Procedure	Assessment Objective Determine if: SC-39 a separate execution domain is maintained for each executing system process. Assessment Methods Examine System design documentation system architecture independent verification and validation documentation testing and evaluation documentation other relevant documents or records Interview System developers/integrators system security architect Test Mechanisms supporting and/or implementing separate execution domains for each executing process
SI-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SI-01a. SI-01a.[01] a system and information integrity policy is developed and documented; SI-01a.[02] the system and information integrity policy is disseminated to [Assignment: personnel or roles]; SI-01a.[03] system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented; SI-01a.[04] the system and information integrity procedures are disseminated to [Assignment: personnel or roles]; SI-01a.01 SI-01a.01(a) SI-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses purpose; SI-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses scope; SI-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses roles; SI-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses responsibilities; SI-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses management commitment; SI-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses coordination among organizational entities; SI-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses compliance; SI-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SI-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; SI-01c. SI-01c.01 SI-01c.01[01] the current system and information integrity policy is reviewed and updated [Assignment: frequency]; SI-01c.01[02] the current system and information integrity policy is reviewed and updated following [Assignment: events]; SI-01c.02 SI-01c.02[01] the current system and information integrity procedures are reviewed and updated [Assignment: frequency]; SI-01c.02[02] the current system and information integrity procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine System and information integrity policy system and information integrity procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with system and information integrity responsibilities organizational personnel with information security and privacy responsibilities
SI-02 [M] Flaw Remediation – Assessment Procedure	Assessment Objective Determine if: SI-02a. SI-02a.[01] system flaws are identified; SI-02a.[02] system flaws are reported; SI-02a.[03] system flaws are corrected; SI-02b. SI-02b.[01] software updates related to flaw remediation are tested for effectiveness before installation; SI-02b.[02] software updates related to flaw remediation are tested for potential side effects before installation; SI-02b.[03] firmware updates related to flaw remediation are tested for effectiveness before installation; SI-02b.[04] firmware updates related to flaw remediation are tested for potential side effects before installation; SI-02c. SI-02c.[01] security-relevant software updates are installed within [Assignment: time period] of the release of the updates; SI-02c.[02] security-relevant firmware updates are installed within [Assignment: time period] of the release of the updates; SI-02d. flaw remediation is incorporated into the organizational configuration management process. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing flaw remediation procedures addressing configuration management list of flaws and vulnerabilities potentially affecting the system list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws) test results from the installation of software and firmware updates to correct system flaws installation/change control records for security-relevant software and firmware updates system security plan privacy plan other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy responsibilities organizational personnel responsible for installing, configuring, and/or maintaining the system organizational personnel responsible for flaw remediation organizational personnel with configuration management responsibilities Test Organizational processes for identifying, reporting, and correcting system flaws organizational process for installing software and firmware updates mechanisms supporting and/or implementing the reporting and correcting of system flaws mechanisms supporting and/or implementing testing software and firmware updates
SI-02(02) [M] Automated Flaw Remediation Status – Assessment Procedure	Assessment Objective Determine if: SI-02(02) system components have applicable security-relevant software and firmware updates installed [Assignment: frequency] using [Assignment: automated mechanisms]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing flaw remediation automated mechanisms supporting centralized management of flaw remediation system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for flaw remediation Test Automated mechanisms used to determine the state of system components with regard to flaw remediation
SI-03 [M] Malicious Code Protection – Assessment Procedure	Assessment Objective Determine if: SI-03a. SI-03a.[01] [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code; SI-03a.[02] [Selection (one or more): signature-based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code; SI-03b. malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures; SI-03c. SI-03c.01 SI-03c.01[01] malicious code protection mechanisms are configured to perform periodic scans of the system [Assignment: frequency]; SI-03c.01[02] malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; SI-03c.02 SI-03c.02[01] malicious code protection mechanisms are configured to [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: action] ] in response to malicious code detection; SI-03c.02[02] malicious code protection mechanisms are configured to send alerts to [Assignment: personnel or roles] in response to malicious code detection; SI-03d. the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed. Assessment Methods Examine System and information integrity policy system and information integrity procedures configuration management policy and procedures procedures addressing malicious code protection malicious code protection mechanisms records of malicious code protection updates system design documentation system configuration settings and associated documentation scan results from malicious code protection mechanisms record of actions initiated by malicious code protection mechanisms in response to malicious code detection system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for malicious code protection organizational personnel with configuration management responsibilities Test Organizational processes for employing, updating, and configuring malicious code protection mechanisms organizational processes for addressing false positives and resulting potential impacts mechanisms supporting and/or implementing, employing, updating, and configuring malicious code protection mechanisms mechanisms supporting and/or implementing malicious code scanning and subsequent actions
SI-04 [M] System Monitoring – Assessment Procedure	Assessment Objective Determine if: SI-04a. SI-04a.01 the system is monitored to detect attacks and indicators of potential attacks in accordance with [Assignment: monitoring objectives]; SI-04a.02 SI-04a.02[01] the system is monitored to detect unauthorized local connections; SI-04a.02[02] the system is monitored to detect unauthorized network connections; SI-04a.02[03] the system is monitored to detect unauthorized remote connections; SI-04b. unauthorized use of the system is identified through [Assignment: techniques and methods]; SI-04c. SI-04c.01 internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information; SI-04c.02 internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization; SI-04d. SI-04d.[01] detected events are analyzed; SI-04d.[02] detected anomalies are analyzed; SI-04e. the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; SI-04f. a legal opinion regarding system monitoring activities is obtained; SI-04g. [Assignment: system monitoring information] is provided to [Assignment: personnel or roles] [Selection (one or more): as needed; [Assignment: frequency] ]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques continuous monitoring strategy facility diagram/layout system design documentation system monitoring tools and techniques documentation locations within the system where monitoring devices are deployed system configuration settings and associated documentation system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system Test Organizational processes for system monitoring mechanisms supporting and/or implementing system monitoring capabilities
SI-04(02) [M] Automated Tools and Mechanisms for Real-time Analysis – Assessment Procedure	Assessment Objective Determine if: SI-04(02) automated tools and mechanisms are employed to support a near real-time analysis of events. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation system audit records system security plan privacy plan privacy program plan privacy impact assessment privacy risk management documentation other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system organizational personnel responsible for incident response/management Test Organizational processes for the near real-time analysis of events organizational processes for system monitoring mechanisms supporting and/or implementing system monitoring mechanisms/tools supporting and/or implementing an analysis of events
SI-04(04) [M] Inbound and Outbound Communications Traffic – Assessment Procedure	Assessment Objective Determine if: SI-04(04)(a) SI-04(04)(a)[01] criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined; SI-04(04)(a)[02] criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined; SI-04(04)(b) SI-04(04)(b)[01] inbound communications traffic is monitored [Assignment: frequency] for [Assignment: unusual or unauthorized activities or conditions]; SI-04(04)(b)[02] outbound communications traffic is monitored [Assignment: frequency] for [Assignment: unusual or unauthorized activities or conditions]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation system protocols system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system organizational personnel responsible for the intrusion detection system Test Organizational processes for intrusion detection and system monitoring mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities mechanisms supporting and/or implementing the monitoring of inbound and outbound communications traffic
SI-04(05) [M] System-generated Alerts – Assessment Procedure	Assessment Objective Determine if: SI-04(05) [Assignment: personnel or roles] are alerted when system-generated [Assignment: compromise indicators] occur. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques system monitoring tools and techniques documentation system configuration settings and associated documentation list of personnel selected to receive alerts documentation of alerts generated based on compromise indicators system audit records system security plan privacy plan other relevant documents or records Interview System/network administrators organizational personnel with information security and privacy responsibilities system developers organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system organizational personnel on the system alert notification list organizational personnel responsible for the intrusion detection system Test Organizational processes for intrusion detection and system monitoring mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities mechanisms supporting and/or implementing alerts for compromise indicators
SI-05 [M] Security Alerts, Advisories, and Directives – Assessment Procedure	Assessment Objective Determine if: SI-05a. system security alerts, advisories, and directives are received from [Assignment: external organizations] on an ongoing basis; SI-05b. internal security alerts, advisories, and directives are generated as deemed necessary; SI-05c. security alerts, advisories, and directives are disseminated to [Selection (one or more): [Assignment: personnel or roles] ; [Assignment: elements] ; [Assignment: external organizations] ]; SI-05d. security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing security alerts, advisories, and directives records of security alerts and advisories system security plan other relevant documents or records Interview Organizational personnel with security alert and advisory responsibilities organizational personnel implementing, operating, maintaining, and using the system organizational personnel, organizational elements, and/or external organizations to whom alerts, advisories, and directives are to be disseminated system/network administrators organizational personnel with information security responsibilities Test Organizational processes for defining, receiving, generating, disseminating, and complying with security alerts, advisories, and directives mechanisms supporting and/or implementing the definition, receipt, generation, and dissemination of security alerts, advisories, and directives mechanisms supporting and/or implementing security directives
SI-07 [M] Software, Firmware, and Information Integrity – Assessment Procedure	Assessment Objective Determine if: SI-07a. SI-07a.[01] integrity verification tools are employed to detect unauthorized changes to [Assignment: software]; SI-07a.[02] integrity verification tools are employed to detect unauthorized changes to [Assignment: firmware]; SI-07a.[03] integrity verification tools are employed to detect unauthorized changes to [Assignment: information]; SI-07b. SI-07b.[01] [Assignment: actions] are taken when unauthorized changes to the software, are detected; SI-07b.[02] [Assignment: actions] are taken when unauthorized changes to the firmware are detected; SI-07b.[03] [Assignment: actions] are taken when unauthorized changes to the information are detected. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity personally identifiable information processing policy system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records generated or triggered by integrity verification tools regarding unauthorized software, firmware, and information changes system audit records system security plan privacy plan other relevant documents or records Interview Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security and privacy responsibilities system/network administrators Test Software, firmware, and information integrity verification tools
SI-07(01) [M] Integrity Checks – Assessment Procedure	Assessment Objective Determine if: SI-07(01)[01] an integrity check of [Assignment: software] is performed [Selection (one or more): at startup; at [Assignment: transitional states or security-relevant events] ; [Assignment: frequency] ]; SI-07(01)[02] an integrity check of [Assignment: firmware] is performed [Selection (one or more): at startup; at [Assignment: transitional states or security-relevant events] ; [Assignment: frequency] ]; SI-07(01)[03] an integrity check of [Assignment: information] is performed [Selection (one or more): at startup; at [Assignment: transitional states or security-relevant events] ; [Assignment: frequency] ]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity testing system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records of integrity scans system security plan other relevant documents or records Interview Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities system/network administrators system developer Test Software, firmware, and information integrity verification tools
SI-07(07) [M] Integration of Detection and Response – Assessment Procedure	Assessment Objective Determine if: SI-07(07) the detection of [Assignment: changes] are incorporated into the organizational incident response capability. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity procedures addressing incident response system design documentation system configuration settings and associated documentation incident response records audit records system security plan other relevant documents or records Interview Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities organizational personnel with incident response responsibilities Test Organizational processes for incorporating the detection of unauthorized security-relevant changes into the incident response capability software, firmware, and information integrity verification tools mechanisms supporting and/or implementing the incorporation of detection of unauthorized security-relevant changes into the incident response capability
SI-08 [M] Spam Protection – Assessment Procedure	Assessment Objective Determine if: SI-08a. SI-08a.[01] spam protection mechanisms are employed at system entry points to detect unsolicited messages; SI-08a.[02] spam protection mechanisms are employed at system exit points to detect unsolicited messages; SI-08a.[03] spam protection mechanisms are employed at system entry points to act on unsolicited messages; SI-08a.[04] spam protection mechanisms are employed at system exit points to act on unsolicited messages; SI-08b. spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures. Assessment Methods Examine System and information integrity policy system and information integrity procedures configuration management policies and procedures (CM-01) procedures addressing spam protection spam protection mechanisms records of spam protection updates system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel responsible for spam protection organizational personnel with information security responsibilities system/network administrators system developer Test Organizational processes for implementing spam protection mechanisms supporting and/or implementing spam protection
SI-08(02) [M] Automatic Updates – Assessment Procedure	Assessment Objective Determine if: SI-08(02) spam protection mechanisms are automatically updated [Assignment: frequency]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing spam protection spam protection mechanisms records of spam protection updates system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel responsible for spam protection organizational personnel with information security responsibilities system/network administrators system developer Test Organizational processes for spam protection mechanisms supporting and/or implementing automatic updates to spam protection mechanisms
SI-10 [M] Information Input Validation – Assessment Procedure	Assessment Objective Determine if: SI-10 the validity of the [Assignment: information inputs] is checked. Assessment Methods Examine System and information integrity policy system and information integrity procedures access control policy and procedures separation of duties policy and procedures procedures addressing information input validation documentation for automated tools and applications to verify the validity of information list of information inputs requiring validity checks system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Organizational personnel responsible for information input validation organizational personnel with information security responsibilities system/network administrators system developer Test Mechanisms supporting and/or implementing validity checks on information inputs
SI-11 [M] Error Handling – Assessment Procedure	Assessment Objective Determine if: SI-11a. error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited; SI-11b. error messages are revealed only to [Assignment: personnel or roles]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system error handling system design documentation system configuration settings and associated documentation documentation providing the structure and content of error messages system audit records system security plan other relevant documents or records Interview Organizational personnel responsible for information input validation organizational personnel with information security responsibilities system/network administrators system developer Test Organizational processes for error handling automated mechanisms supporting and/or implementing error handling automated mechanisms supporting and/or implementing the management of error messages
SI-12 [M] Information Management and Retention – Assessment Procedure	Assessment Objective Determine if: SI-12[01] information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements; SI-12[02] information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements; SI-12[03] information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements; SI-12[04] information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. Assessment Methods Examine System and information integrity policy system and information integrity procedures personally identifiable information processing policy records retention and disposition policy records retention and disposition procedures federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention media protection policy media protection procedures audit findings system security plan privacy plan privacy program plan personally identifiable information inventory privacy impact assessment privacy risk assessment documentation other relevant documents or records Interview Organizational personnel with information and records management, retention, and disposition responsibilities organizational personnel with information security and privacy responsibilities network administrators Test Organizational processes for information management, retention, and disposition automated mechanisms supporting and/or implementing information management, retention, and disposition
SI-16 [M] Memory Protection – Assessment Procedure	Assessment Objective Determine if: SI-16 [Assignment: controls] are implemented to protect the system memory from unauthorized code execution. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing memory protection for the system system design documentation system configuration settings and associated documentation list of security safeguards protecting system memory from unauthorized code execution system audit records system security plan other relevant documents or records Interview Organizational personnel responsible for memory protection organizational personnel with information security responsibilities system/network administrators system developer Test Automated mechanisms supporting and/or implementing safeguards to protect the system memory from unauthorized code execution
SR-01 [M] Policy and Procedures – Assessment Procedure	Assessment Objective Determine if: SR-01a. SR-01a.[01] a supply chain risk management policy is developed and documented; SR-01a.[02] the supply chain risk management policy is disseminated to [Assignment: personnel or roles]; SR-01a.[03] supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented; SR-01a.[04] the supply chain risk management procedures are disseminated to [Assignment: personnel or roles]. SR-01a.01 SR-01a.01(a) SR-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses purpose; SR-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses scope; SR-01a.01(a)[03] [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses roles; SR-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses responsibilities; SR-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses management commitment; SR-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses coordination among organizational entities; SR-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses compliance. SR-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; SR-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; SR-01c. SR-01c.01 SR-01c.01[01] the current supply chain risk management policy is reviewed and updated [Assignment: frequency]; SR-01c.01[02] the current supply chain risk management policy is reviewed and updated following [Assignment: events]; SR-01c.02 SR-01c.02[01] the current supply chain risk management procedures are reviewed and updated [Assignment: frequency]; SR-01c.02[02] the current supply chain risk management procedures are reviewed and updated following [Assignment: events]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures system security plan privacy plan other relevant documents or records Interview Organizational personnel with supply chain risk management responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with acquisition responsibilities organizational personnel with enterprise risk management responsibilities
SR-02 [M] Supply Chain Risk Management Plan – Assessment Procedure	Assessment Objective Determine if: SR-02a. SR-02a.[01] a plan for managing supply chain risks is developed; SR-02a.[02] the supply chain risk management plan addresses risks associated with the research and development of [Assignment: systems, system components, or system services]; SR-02a.[03] the supply chain risk management plan addresses risks associated with the design of [Assignment: systems, system components, or system services]; SR-02a.[04] the supply chain risk management plan addresses risks associated with the manufacturing of [Assignment: systems, system components, or system services]; SR-02a.[05] the supply chain risk management plan addresses risks associated with the acquisition of [Assignment: systems, system components, or system services]; SR-02a.[06] the supply chain risk management plan addresses risks associated with the delivery of [Assignment: systems, system components, or system services]; SR-02a.[07] the supply chain risk management plan addresses risks associated with the integration of [Assignment: systems, system components, or system services]; SR-02a.[08] the supply chain risk management plan addresses risks associated with the operation and maintenance of [Assignment: systems, system components, or system services]; SR-02a.[09] the supply chain risk management plan addresses risks associated with the disposal of [Assignment: systems, system components, or system services]; SR-02b. the supply chain risk management plan is reviewed and updated [Assignment: frequency] or as required to address threat, organizational, or environmental changes; SR-02c. SR-02c.[01] the supply chain risk management plan is protected from unauthorized disclosure; SR-02c.[02] the supply chain risk management plan is protected from unauthorized modification. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management plan system and services acquisition policy system and services acquisition procedures procedures addressing supply chain protection procedures for protecting the supply chain risk management plan from unauthorized disclosure and modification system development life cycle procedures procedures addressing the integration of information security and privacy requirements into the acquisition process acquisition documentation service level agreements acquisition contracts for the system, system component, or system service list of supply chain threats list of safeguards to be taken against supply chain threats system life cycle documentation inter-organizational agreements and procedures system security plan privacy plan privacy program plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for defining and documenting the system development life cycle (SDLC) organizational processes for identifying SDLC roles and responsibilities organizational processes for integrating supply chain risk management into the SDLC mechanisms supporting and/or implementing the SDLC
SR-02(01) [M] Establish SCRM Team – Assessment Procedure	Assessment Objective Determine if: SR-02(01) a supply chain risk management team consisting of [Assignment: personnel, roles and responsibilities] is established to lead and support [Assignment: supply chain risk management activities]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management team charter documentation supply chain risk management strategy supply chain risk management implementation plan procedures addressing supply chain protection system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with enterprise risk management responsibilities legal counsel organizational personnel with business continuity responsibilities
SR-03 [M] Supply Chain Controls and Processes – Assessment Procedure	Assessment Objective Determine if: SR-03a. SR-03a.[01] a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component]; SR-03a.[02] the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component] is/are coordinated with [Assignment: supply chain personnel]; SR-03b. [Assignment: supply chain controls] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events; SR-03c. the selected and implemented supply chain processes and controls are documented in [Selection (one or more): security and privacy plans; supply chain risk management plan; [Assignment: document] ]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management strategy supply chain risk management plan systems and critical system components inventory documentation system and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service level agreements acquisition contracts for systems or services risk register documentation system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for identifying and addressing supply chain element and process deficiencies
SR-05 [M] Acquisition Strategies, Tools, and Methods – Assessment Procedure	Assessment Objective Determine if: SR-05[01] [Assignment: strategies, tools, and methods] are employed to protect against supply chain risks; SR-05[02] [Assignment: strategies, tools, and methods] are employed to identify supply chain risks; SR-05[03] [Assignment: strategies, tools, and methods] are employed to mitigate supply chain risks. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management plan system and services acquisition policy system and services acquisition procedures procedures addressing supply chain protection procedures addressing the integration of information security and privacy requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service level agreements acquisition contracts for systems, system components, or services documentation of training, education, and awareness programs for personnel regarding supply chain risk system security plan privacy plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods mechanisms supporting and/or implementing the definition and employment of tailored acquisition strategies, contract tools, and procurement methods
SR-06 [M] Supplier Assessments and Reviews – Assessment Procedure	Assessment Objective Determine if: SR-06 the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed [Assignment: frequency]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management strategy supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection procedures addressing the integration of information security requirements into the acquisition process records of supplier due diligence reviews system security plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain protection responsibilities Test Organizational processes for conducting supplier reviews mechanisms supporting and/or implementing supplier reviews
SR-08 [M] Notification Agreements – Assessment Procedure	Assessment Objective Determine if: SR-08 agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Selection (one or more): notification of supply chain compromises; [Assignment: results of assessments or audits] ]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
SR-10 [M] Inspection of Systems or Components – Assessment Procedure	Assessment Objective Determine if: SR-10 [Assignment: systems or system components] are inspected [Selection (one or more): at random; at [Assignment: frequency] ; upon [Assignment: indications of need for inspection] ] to detect tampering. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy records of random inspections inspection reports/results assessment reports/results acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities organizational processes to inspect for tampering
SR-11 [M] Component Authenticity – Assessment Procedure	Assessment Objective Determine if: SR-11a. SR-11a.[01] an anti-counterfeit policy is developed and implemented; SR-11a.[02] anti-counterfeit procedures are developed and implemented; SR-11a.[03] the anti-counterfeit procedures include the means to detect counterfeit components entering the system; SR-11a.[04] the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system; SR-11b. counterfeit system components are reported to [Selection (one or more): source of counterfeit component; [Assignment: external reporting organizations] ; [Assignment: personnel or roles] ]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures records of reported counterfeit system components system security plan other relevant documents or records Interview Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting Test Organizational processes for counterfeit prevention, detection, and reporting mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting
SR-11(01) [M] Anti-counterfeit Training – Assessment Procedure	Assessment Objective Determine if: SR-11(01) [Assignment: personnel or roles] are trained to detect counterfeit system components (including hardware, software, and firmware). Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy training materials addressing counterfeit system components training records on the detection and prevention of counterfeit components entering the system system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with responsibilities for anti-counterfeit policies, procedures, and training Test Organizational processes for anti-counterfeit training
SR-11(02) [M] Configuration Control for Component Service and Repair – Assessment Procedure	Assessment Objective Determine if: SR-11(02)[01] configuration control over [Assignment: system components] awaiting service or repair is maintained; SR-11(02)[02] configuration control over serviced or repaired [Assignment: system components] awaiting return to service is maintained. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan configuration control procedures acquisition documentation service level agreements acquisition contracts for the system component inter-organizational agreements and procedures system security plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities organizational configuration control processes
SR-12 [M] Component Disposal – Assessment Procedure	Assessment Objective Determine if: SR-12 [Assignment: data, documentation, tools, or system components] are disposed of using [Assignment: techniques and methods]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan disposal procedures addressing supply chain protection media disposal policy media protection policy disposal records for system components documentation of the system components identified for disposal documentation of the disposal techniques and methods employed for system components system security plan other relevant documents or records Interview Organizational personnel with system component disposal responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain protection responsibilities Test Organizational techniques and methods for system component disposal mechanisms supporting and/or implementing system component disposal

NIST -
https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Undersager

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective