+Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.1.1 HIGH IMPACT BASELINE
---+AC [H] Access Control
------+AC-01 [H] Policy and Procedures
------+AC-02 [H] Account Management
---------+AC-02(01) [H] Automated System Account Management
---------+AC-02(02) [H] Automated Temporary and Emergency Account Management
---------+AC-02(03) [H] Disable Accounts
---------+AC-02(04) [H] Automated Audit Actions
---------+AC-02(05) [H] Inactivity Logout
---------+AC-02(11) [H] Usage Conditions
---------+AC-02(12) [H] Account Monitoring for Atypical Usage
---------+AC-02(13) [H] Disable Accounts for High-risk Individuals
------+AC-03 [H] Access Enforcement
------+AC-04 [H] Information Flow Enforcement
---------+AC-04(04) [H] Flow Control of Encrypted Information
------+AC-05 [H] Separation of Duties
------+AC-06 [H] Least Privilege
---------+AC-06(01) [H] Authorize Access to Security Functions
---------+AC-06(02) [H] Non-privileged Access for Nonsecurity Functions
---------+AC-06(03) [H] Network Access to Privileged Commands
---------+AC-06(05) [H] Privileged Accounts
---------+AC-06(07) [H] Review of User Privileges
---------+AC-06(09) [H] Log Use of Privileged Functions
---------+AC-06(10) [H] Prohibit Non-privileged Users from Executing Privileged Functions
------+AC-07 [H] Unsuccessful Logon Attempts
------+AC-08 [H] System Use Notification
------+AC-10 [H] Concurrent Session Control
------+AC-11 [H] Device Lock
---------+AC-11(01) [H] Pattern-hiding Displays
------+AC-12 [H] Session Termination
------+AC-14 [H] Permitted Actions Without Identification or Authentication
------+AC-17 [H] Remote Access
---------+AC-17(01) [H] Monitoring and Control
---------+AC-17(02) [H] Protection of Confidentiality and Integrity Using Encryption
---------+AC-17(03) [H] Managed Access Control Points
---------+AC-17(04) [H] Privileged Commands and Access
------+AC-18 [H] Wireless Access
---------+AC-18(01) [H] Authentication and Encryption
---------+AC-18(03) [H] Disable Wireless Networking
---------+AC-18(04) [H] Restrict Configurations by Users
---------+AC-18(05) [H] Antennas and Transmission Power Levels
------+AC-19 [H] Access Control for Mobile Devices
---------+AC-19(05) [H] Full Device or Container-based Encryption
------+AC-20 [H] Use of External Systems
---------+AC-20(01) [H] Limits on Authorized Use
---------+AC-20(02) [H] Portable Storage Devices — Restricted Use
------+AC-21 [H] Information Sharing
------+AC-22 [H] Publicly Accessible Content
---+AT [H] Awareness and Training
------+AT-01 [H] Policy and Procedures
------+AT-02 [H] Literacy Training and Awareness
---------+AT-02(02) [H] Insider Threat
---------+AT-02(03) [H] Social Engineering and Mining
------+AT-03 [H] Role-based Training
------+AT-04 [H] Training Records
---+AU [H] Audit and Accountability
------+AU-01 [H] Policy and Procedures
------+AU-02 [H] Event Logging
------+AU-03 [H] Content of Audit Records
---------+AU-03(01) [H] Additional Audit Information
------+AU-04 [H] Audit Log Storage Capacity
------+AU-05 [H] Response to Audit Logging Process Failures
---------+AU-05(01) [H] Storage Capacity Warning
---------+AU-05(02) [H] Real-time Alerts
------+AU-06 [H] Audit Record Review, Analysis, and Reporting
---------+AU-06(01) [H] Automated Process Integration
---------+AU-06(03) [H] Correlate Audit Record Repositories
---------+AU-06(05) [H] Integrated Analysis of Audit Records
---------+AU-06(06) [H] Correlation with Physical Monitoring
------+AU-07 [H] Audit Record Reduction and Report Generation
---------+AU-07(01) [H] Automatic Processing
------+AU-08 [H] Time Stamps
------+AU-09 [H] Protection of Audit Information
---------+AU-09(02) [H] Store on Separate Physical Systems or Components
---------+AU-09(03) [H] Cryptographic Protection
---------+AU-09(04) [H] Access by Subset of Privileged Users
------+AU-10 [H] Non-repudiation
------+AU-11 [H] Audit Record Retention
------+AU-12 [H] Audit Record Generation
---------+AU-12(01) [H] System-wide and Time-correlated Audit Trail
---------+AU-12(03) [H] Changes by Authorized Individuals
---+CA [H] Assessment, Authorization, and Monitoring
------+CA-01 [H] Policy and Procedures
------+CA-02 [H] Control Assessments
---------+CA-02(01) [H] Independent Assessors
---------+CA-02(02) [H] Specialized Assessments
------+CA-03 [H] Information Exchange
---------+CA-03(06) [H] Transfer Authorizations
------+CA-05 [H] Plan of Action and Milestones
------+CA-06 [H] Authorization
------+CA-07 [H] Continuous Monitoring
---------+CA-07(01) [H] Independent Assessment
---------+CA-07(04) [H] Risk Monitoring
------+CA-08 [H] Penetration Testing
---------+CA-08(01) [H] Independent Penetration Testing Agent or Team
------+CA-09 [H] Internal System Connections
---+CM [H] Configuration Management
------+CM-01 [H] Policy and Procedures
------+CM-02 [H] Baseline Configuration
---------+CM-02(02) [H] Automation Support for Accuracy and Currency
---------+CM-02(03) [H] Retention of Previous Configurations
---------+CM-02(07) [H] Configure Systems and Components for High-risk Areas
------+CM-03 [H] Configuration Change Control
---------+CM-03(01) [H] Automated Documentation, Notification, and Prohibition of Changes
---------+CM-03(02) [H] Testing, Validation, and Documentation of Changes
---------+CM-03(04) [H] Security and Privacy Representatives
---------+CM-03(06) [H] Cryptography Management
------+CM-04 [H] Impact Analyses
---------+CM-04(01) [H] Separate Test Environments
---------+CM-04(02) [H] Verification of Controls
------+CM-05 [H] Access Restrictions for Change
---------+CM-05(01) [H] Automated Access Enforcement and Audit Records
------+CM-06 [H] Configuration Settings
---------+CM-06(01) [H] Automated Management, Application, and Verification
---------+CM-06(02) [H] Respond to Unauthorized Changes
------+CM-07 [H] Least Functionality
---------+CM-07(01) [H] Periodic Review
---------+CM-07(02) [H] Prevent Program Execution
---------+CM-07(05) [H] Authorized Software — Allow-by-exception
------+CM-08 [H] System Component Inventory
---------+CM-08(01) [H] Updates During Installation and Removal
---------+CM-08(02) [H] Automated Maintenance
---------+CM-08(03) [H] Automated Unauthorized Component Detection
---------+CM-08(04) [H] Accountability Information
------+CM-09 [H] Configuration Management Plan
------+CM-10 [H] Software Usage Restrictions
------+CM-11 [H] User-installed Software
------+CM-12 [H] Information Location
---------+CM-12(01) [H] Automated Tools to Support Information Location
---+CP [H] Contingency Planning
------+CP-01 [H] Policy and Procedures
------+CP-02 [H] Contingency Plan
---------+CP-02(01) [H] Coordinate with Related Plans
---------+CP-02(02) [H] Capacity Planning
---------+CP-02(03) [H] Resume Mission and Business Functions
---------+CP-02(05) [H] Continue Mission and Business Functions
---------+CP-02(08) [H] Identify Critical Assets
------+CP-03 [H] Contingency Training
---------+CP-03(01) [H] Simulated Events
------+CP-04 [H] Contingency Plan Testing
---------+CP-04(01) [H] Coordinate with Related Plans
---------+CP-04(02) [H] Alternate Processing Site
------+CP-06 [H] Alternate Storage Site
---------+CP-06(01) [H] Separation from Primary Site
---------+CP-06(02) [H] Recovery Time and Recovery Point Objectives
---------+CP-06(03) [H] Accessibility
------+CP-07 [H] Alternate Processing Site
---------+CP-07(01) [H] Separation from Primary Site
---------+CP-07(02) [H] Accessibility
---------+CP-07(03) [H] Priority of Service
---------+CP-07(04) [H] Preparation for Use
------+CP-08 [H] Telecommunications Services
---------+CP-08(01) [H] Priority of Service Provisions
---------+CP-08(02) [H] Single Points of Failure
---------+CP-08(03) [H] Separation of Primary and Alternate Providers
---------+CP-08(04) [H] Provider Contingency Plan
------+CP-09 [H] System Backup
---------+CP-09(01) [H] Testing for Reliability and Integrity
---------+CP-09(02) [H] Test Restoration Using Sampling
---------+CP-09(03) [H] Separate Storage for Critical Information
---------+CP-09(05) [H] Transfer to Alternate Storage Site
---------+CP-09(08) [H] Cryptographic Protection
------+CP-10 [H] System Recovery and Reconstitution
---------+CP-10(02) [H] Transaction Recovery
---------+CP-10(04) [H] Restore Within Time Period
---+IA [H] Identification and Authentication
------+IA-01 [H] Policy and Procedures
------+IA-02 [H] Identification and Authentication (Organizational Users)
---------+IA-02(01) [H] Multi-factor Authentication to Privileged Accounts
---------+IA-02(02) [H] Multi-factor Authentication to Non-privileged Accounts
---------+IA-02(05) [H] Individual Authentication with Group Authentication
---------+IA-02(08) [H] Access to Accounts — Replay Resistant
---------+IA-02(12) [H] Acceptance of PIV Credentials
------+IA-03 [H] Device Identification and Authentication
------+IA-04 [H] Identifier Management
---------+IA-04(04) [H] Identify User Status
------+IA-05 [H] Authenticator Management
---------+IA-05(01) [H] Password-based Authentication
---------+IA-05(02) [H] Public Key-based Authentication
---------+IA-05(06) [H] Protection of Authenticators
------+IA-06 [H] Authentication Feedback
------+IA-07 [H] Cryptographic Module Authentication
------+IA-08 [H] Identification and Authentication (Non-organizational Users)
---------+IA-08(01) [H] Acceptance of PIV Credentials from Other Agencies
---------+IA-08(02) [H] Acceptance of External Authenticators
---------+IA-08(04) [H] Use of Defined Profiles
------+IA-11 [H] Re-authentication
------+IA-12 [H] Identity Proofing
---------+IA-12(02) [H] Identity Evidence
---------+IA-12(03) [H] Identity Evidence Validation and Verification
---------+IA-12(04) [H] In-person Validation and Verification
---------+IA-12(05) [H] Address Confirmation
---+IR [H] Incident Response
------+IR-01 [H] Policy and Procedures
------+IR-02 [H] Incident Response Training
---------+IR-02(01) [H] Simulated Events
---------+IR-02(02) [H] Automated Training Environments
------+IR-03 [H] Incident Response Testing
---------+IR-03(02) [H] Coordination with Related Plans
------+IR-04 [H] Incident Handling
---------+IR-04(01) [H] Automated Incident Handling Processes
---------+IR-04(04) [H] Information Correlation
---------+IR-04(11) [H] Integrated Incident Response Team
------+IR-05 [H] Incident Monitoring
---------+IR-05(01) [H] Automated Tracking, Data Collection, and Analysis
------+IR-06 [H] Incident Reporting
---------+IR-06(01) [H] Automated Reporting
---------+IR-06(03) [H] Supply Chain Coordination
------+IR-07 [H] Incident Response Assistance
---------+IR-07(01) [H] Automation Support for Availability of Information and Support
------+IR-08 [H] Incident Response Plan
---+MA [H] Maintenance
------+MA-01 [H] Policy and Procedures
------+MA-02 [H] Controlled Maintenance
---------+MA-02(02) [H] Automated Maintenance Activities
------+MA-03 [H] Maintenance Tools
---------+MA-03(01) [H] Inspect Tools
---------+MA-03(02) [H] Inspect Media
---------+MA-03(03) [H] Prevent Unauthorized Removal
------+MA-04 [H] Nonlocal Maintenance
---------+MA-04(03) [H] Comparable Security and Sanitization
------+MA-05 [H] Maintenance Personnel
---------+MA-05(01) [H] Individuals Without Appropriate Access
------+MA-06 [H] Timely Maintenance
---+MP [H] Media Protection
------+MP-01 [H] Policy and Procedures
------+MP-02 [H] Media Access
------+MP-03 [H] Media Marking
------+MP-04 [H] Media Storage
------+MP-05 [H] Media Transport
------+MP-06 [H] Media Sanitization
---------+MP-06(01) [H] Review, Approve, Track, Document, and Verify
---------+MP-06(02) [H] Equipment Testing
---------+MP-06(03) [H] Nondestructive Techniques
------+MP-07 [H] Media Use
---+PE [H] Physical and Environmental Protection
------+PE-01 [H] Policy and Procedures
------+PE-02 [H] Physical Access Authorizations
------+PE-03 [H] Physical Access Control
---------+PE-03(01) [H] System Access
------+PE-04 [H] Access Control for Transmission
------+PE-05 [H] Access Control for Output Devices
------+PE-06 [H] Monitoring Physical Access
---------+PE-06(01) [H] Intrusion Alarms and Surveillance Equipment
---------+PE-06(04) [H] Monitoring Physical Access to Systems
------+PE-08 [H] Visitor Access Records
---------+PE-08(01) [H] Automated Records Maintenance and Review
------+PE-09 [H] Power Equipment and Cabling
------+PE-10 [H] Emergency Shutoff
------+PE-11 [H] Emergency Power
---------+PE-11(01) [H] Alternate Power Supply — Minimal Operational Capability
------+PE-12 [H] Emergency Lighting
------+PE-13 [H] Fire Protection
---------+PE-13(01) [H] Detection Systems — Automatic Activation and Notification
---------+PE-13(02) [H] Suppression Systems — Automatic Activation and Notification
------+PE-14 [H] Environmental Controls
------+PE-15 [H] Water Damage Protection
---------+PE-15(01) [H] Automation Support
------+PE-16 [H] Delivery and Removal
------+PE-17 [H] Alternate Work Site
------+PE-18 [H] Location of System Components
---+PL [H] Planning
------+PL-01 [H] Policy and Procedures
------+PL-02 [H] System Security and Privacy Plans
------+PL-04 [H] Rules of Behavior
---------+PL-04(01) [H] Social Media and External Site/Application Usage Restrictions
------+PL-08 [H] Security and Privacy Architectures
------+PL-10 [H] Baseline Selection
------+PL-11 [H] Baseline Tailoring
---+PS [H] Personnel Security
------+PS-01 [H] Policy and Procedures
------+PS-02 [H] Position Risk Designation
------+PS-03 [H] Personnel Screening
------+PS-04 [H] Personnel Termination
---------+PS-04(02) [H] Automated Actions
------+PS-05 [H] Personnel Transfer
------+PS-06 [H] Access Agreements
------+PS-07 [H] External Personnel Security
------+PS-08 [H] Personnel Sanctions
------+PS-09 [H] Position Descriptions
---+RA [H] Risk Assessment
------+RA-01 [H] Policy and Procedures
------+RA-02 [H] Security Categorization
------+RA-03 [H] Risk Assessment
---------+RA-03(01) [H] Supply Chain Risk Assessment
------+RA-05 [H] Vulnerability Monitoring and Scanning
---------+RA-05(02) [H] Update Vulnerabilities to Be Scanned
---------+RA-05(04) [H] Discoverable Information
---------+RA-05(05) [H] Privileged Access
---------+RA-05(11) [H] Public Disclosure Program
------+RA-07 [H] Risk Response
------+RA-09 [H] Criticality Analysis
---+SA [H] System and Services Acquisition
------+SA-01 [H] Policy and Procedures
------+SA-02 [H] Allocation of Resources
------+SA-03 [H] System Development Life Cycle
------+SA-04 [H] Acquisition Process
---------+SA-04(01) [H] Functional Properties of Controls
---------+SA-04(02) [H] Design and Implementation Information for Controls
---------+SA-04(05) [H] System, Component, and Service Configurations
---------+SA-04(09) [H] Functions, Ports, Protocols, and Services in Use
---------+SA-04(10) [H] Use of Approved PIV Products
------+SA-05 [H] System Documentation
------+SA-08 [H] Security and Privacy Engineering Principles
------+SA-09 [H] External System Services
---------+SA-09(02) [H] Identification of Functions, Ports, Protocols, and Services
------+SA-10 [H] Developer Configuration Management
------+SA-11 [H] Developer Testing and Evaluation
------+SA-15 [H] Development Process, Standards, and Tools
---------+SA-15(03) [H] Criticality Analysis
------+SA-16 [H] Developer-provided Training
------+SA-17 [H] Developer Security and Privacy Architecture and Design
------+SA-21 [H] Developer Screening
------+SA-22 [H] Unsupported System Components
---+SC [H] System and Communications Protection
------+SC-01 [H] Policy and Procedures
------+SC-02 [H] Separation of System and User Functionality
------+SC-03 [H] Security Function Isolation
------+SC-04 [H] Information in Shared System Resources
------+SC-05 [H] Denial-of-service Protection
------+SC-07 [H] Boundary Protection
---------+SC-07(03) [H] Access Points
---------+SC-07(04) [H] External Telecommunications Services
---------+SC-07(05) [H] Deny by Default — Allow by Exception
---------+SC-07(07) [H] Split Tunneling for Remote Devices
---------+SC-07(08) [H] Route Traffic to Authenticated Proxy Servers
---------+SC-07(18) [H] Fail Secure
---------+SC-07(21) [H] Isolation of System Components
------+SC-08 [H] Transmission Confidentiality and Integrity
---------+SC-08(01) [H] Cryptographic Protection
------+SC-10 [H] Network Disconnect
------+SC-12 [H] Cryptographic Key Establishment and Management
---------+SC-12(01) [H] Availability
------+SC-13 [H] Cryptographic Protection
------+SC-15 [H] Collaborative Computing Devices and Applications
------+SC-17 [H] Public Key Infrastructure Certificates
------+SC-18 [H] Mobile Code
------+SC-20 [H] Secure Name/Address Resolution Service (Authoritative Source)
------+SC-21 [H] Secure Name/Address Resolution Service (Recursive or Caching Resolver)
------+SC-22 [H] Architecture and Provisioning for Name/Address Resolution Service
------+SC-23 [H] Session Authenticity
------+SC-24 [H] Fail in Known State
------+SC-28 [H] Protection of Information at Rest
---------+SC-28(01) [H] Cryptographic Protection
------+SC-39 [H] Process Isolation
---+SI [H] System and Information Integrity
------+SI-01 [H] Policy and Procedures
------+SI-02 [H] Flaw Remediation
---------+SI-02(02) [H] Automated Flaw Remediation Status
------+SI-03 [H] Malicious Code Protection
------+SI-04 [H] System Monitoring
---------+SI-04(02) [H] Automated Tools and Mechanisms for Real-time Analysis
---------+SI-04(04) [H] Inbound and Outbound Communications Traffic
---------+SI-04(05) [H] System-generated Alerts
---------+SI-04(10) [H] Visibility of Encrypted Communications
---------+SI-04(12) [H] Automated Organization-generated Alerts
---------+SI-04(14) [H] Wireless Intrusion Detection
---------+SI-04(20) [H] Privileged Users
---------+SI-04(22) [H] Unauthorized Network Services
------+SI-05 [H] Security Alerts, Advisories, and Directives
---------+SI-05(01) [H] Automated Alerts and Advisories
------+SI-06 [H] Security and Privacy Function Verification
------+SI-07 [H] Software, Firmware, and Information Integrity
---------+SI-07(01) [H] Integrity Checks
---------+SI-07(02) [H] Automated Notifications of Integrity Violations
---------+SI-07(05) [H] Automated Response to Integrity Violations
---------+SI-07(07) [H] Integration of Detection and Response
---------+SI-07(15) [H] Code Authentication
------+SI-08 [H] Spam Protection
---------+SI-08(02) [H] Automatic Updates
------+SI-10 [H] Information Input Validation
------+SI-11 [H] Error Handling
------+SI-12 [H] Information Management and Retention
------+SI-16 [H] Memory Protection
---+SR [H] Supply Chain Risk Management
------+SR-01 [H] Policy and Procedures
------+SR-02 [H] Supply Chain Risk Management Plan
---------+SR-02(01) [H] Establish SCRM Team
------+SR-03 [H] Supply Chain Controls and Processes
------+SR-05 [H] Acquisition Strategies, Tools, and Methods
------+SR-06 [H] Supplier Assessments and Reviews
------+SR-08 [H] Notification Agreements
------+SR-09 [H] Tamper Resistance and Detection
---------+SR-09(01) [H] Multiple Stages of System Development Life Cycle
------+SR-10 [H] Inspection of Systems or Components
------+SR-11 [H] Component Authenticity
---------+SR-11(01) [H] Anti-counterfeit Training
---------+SR-11(02) [H] Configuration Control for Component Service and Repair
------+SR-12 [H] Component Disposal
---+NIST SP 800-53 Rev. 5 HIGH Baseline – Assessment Procedures
------+AC-01 [H] Policy and Procedures – Assessment Procedure
------+AC-02 [H] Account Management – Assessment Procedure
------+AC-02(01) [H] Automated System Account Management – Assessment Procedure
------+AC-02(02) [H] Automated Temporary and Emergency Account Management – Assessment Procedure
------+AC-02(03) [H] Disable Accounts – Assessment Procedure
------+AC-02(04) [H] Automated Audit Actions – Assessment Procedure
------+AC-02(05) [H] Inactivity Logout – Assessment Procedure
------+AC-02(11) [H] Usage Conditions – Assessment Procedure
------+AC-02(12) [H] Account Monitoring for Atypical Usage – Assessment Procedure
------+AC-02(13) [H] Disable Accounts for High-risk Individuals – Assessment Procedure
------+AC-03 [H] Access Enforcement – Assessment Procedure
------+AC-04 [H] Information Flow Enforcement – Assessment Procedure
------+AC-04(04) [H] Flow Control of Encrypted Information – Assessment Procedure
------+AC-05 [H] Separation of Duties – Assessment Procedure
------+AC-06 [H] Least Privilege – Assessment Procedure
------+AC-06(01) [H] Authorize Access to Security Functions – Assessment Procedure
------+AC-06(02) [H] Non-privileged Access for Nonsecurity Functions – Assessment Procedure
------+AC-06(03) [H] Network Access to Privileged Commands – Assessment Procedure
------+AC-06(05) [H] Privileged Accounts – Assessment Procedure
------+AC-06(07) [H] Review of User Privileges – Assessment Procedure
------+AC-06(09) [H] Log Use of Privileged Functions – Assessment Procedure
------+AC-06(10) [H] Prohibit Non-privileged Users from Executing Privileged Functions – Assessment Procedure
------+AC-07 [H] Unsuccessful Logon Attempts – Assessment Procedure
------+AC-08 [H] System Use Notification – Assessment Procedure
------+AC-10 [H] Concurrent Session Control – Assessment Procedure
------+AC-11 [H] Device Lock – Assessment Procedure
------+AC-11(01) [H] Pattern-hiding Displays – Assessment Procedure
------+AC-12 [H] Session Termination – Assessment Procedure
------+AC-14 [H] Permitted Actions Without Identification or Authentication – Assessment Procedure
------+AC-17 [H] Remote Access – Assessment Procedure
------+AC-17(01) [H] Monitoring and Control – Assessment Procedure
------+AC-17(02) [H] Protection of Confidentiality and Integrity Using Encryption – Assessment Procedure
------+AC-17(03) [H] Managed Access Control Points – Assessment Procedure
------+AC-17(04) [H] Privileged Commands and Access – Assessment Procedure
------+AC-18 [H] Wireless Access – Assessment Procedure
------+AC-18(01) [H] Authentication and Encryption – Assessment Procedure
------+AC-18(03) [H] Disable Wireless Networking – Assessment Procedure
------+AC-18(04) [H] Restrict Configurations by Users – Assessment Procedure
------+AC-18(05) [H] Antennas and Transmission Power Levels – Assessment Procedure
------+AC-19 [H] Access Control for Mobile Devices – Assessment Procedure
------+AC-19(05) [H] Full Device or Container-based Encryption – Assessment Procedure
------+AC-20 [H] Use of External Systems – Assessment Procedure
------+AC-20(01) [H] Limits on Authorized Use – Assessment Procedure
------+AC-20(02) [H] Portable Storage Devices — Restricted Use – Assessment Procedure
------+AC-21 [H] Information Sharing – Assessment Procedure
------+AC-22 [H] Publicly Accessible Content – Assessment Procedure
------+AT-01 [H] Policy and Procedures – Assessment Procedure
------+AT-02 [H] Literacy Training and Awareness – Assessment Procedure
------+AT-02(02) [H] Insider Threat – Assessment Procedure
------+AT-02(03) [H] Social Engineering and Mining – Assessment Procedure
------+AT-03 [H] Role-based Training – Assessment Procedure
------+AT-04 [H] Training Records – Assessment Procedure
------+AU-01 [H] Policy and Procedures – Assessment Procedure
------+AU-02 [H] Event Logging – Assessment Procedure
------+AU-03 [H] Content of Audit Records – Assessment Procedure
------+AU-03(01) [H] Additional Audit Information – Assessment Procedure
------+AU-04 [H] Audit Log Storage Capacity – Assessment Procedure
------+AU-05 [H] Response to Audit Logging Process Failures – Assessment Procedure
------+AU-05(01) [H] Storage Capacity Warning – Assessment Procedure
------+AU-05(02) [H] Real-time Alerts – Assessment Procedure
------+AU-06 [H] Audit Record Review, Analysis, and Reporting – Assessment Procedure
------+AU-06(01) [H] Automated Process Integration – Assessment Procedure
------+AU-06(03) [H] Correlate Audit Record Repositories – Assessment Procedure
------+AU-06(05) [H] Integrated Analysis of Audit Records – Assessment Procedure
------+AU-06(06) [H] Correlation with Physical Monitoring – Assessment Procedure
------+AU-07 [H] Audit Record Reduction and Report Generation – Assessment Procedure
------+AU-07(01) [H] Automatic Processing – Assessment Procedure
------+AU-08 [H] Time Stamps – Assessment Procedure
------+AU-09 [H] Protection of Audit Information – Assessment Procedure
------+AU-09(02) [H] Store on Separate Physical Systems or Components – Assessment Procedure
------+AU-09(03) [H] Cryptographic Protection – Assessment Procedure
------+AU-09(04) [H] Access by Subset of Privileged Users – Assessment Procedure
------+AU-10 [H] Non-repudiation – Assessment Procedure
------+AU-11 [H] Audit Record Retention – Assessment Procedure
------+AU-12 [H] Audit Record Generation – Assessment Procedure
------+AU-12(01) [H] System-wide and Time-correlated Audit Trail – Assessment Procedure
------+AU-12(03) [H] Changes by Authorized Individuals – Assessment Procedure
------+CA-01 [H] Policy and Procedures – Assessment Procedure
------+CA-02 [H] Control Assessments – Assessment Procedure
------+CA-02(01) [H] Independent Assessors – Assessment Procedure
------+CA-02(02) [H] Specialized Assessments – Assessment Procedure
------+CA-03 [H] Information Exchange – Assessment Procedure
------+CA-03(06) [H] Transfer Authorizations – Assessment Procedure
------+CA-05 [H] Plan of Action and Milestones – Assessment Procedure
------+CA-06 [H] Authorization – Assessment Procedure
------+CA-07 [H] Continuous Monitoring – Assessment Procedure
------+CA-07(01) [H] Independent Assessment – Assessment Procedure
------+CA-07(04) [H] Risk Monitoring – Assessment Procedure
------+CA-08 [H] Penetration Testing – Assessment Procedure
------+CA-08(01) [H] Independent Penetration Testing Agent or Team – Assessment Procedure
------+CA-09 [H] Internal System Connections – Assessment Procedure
------+CM-01 [H] Policy and Procedures – Assessment Procedure
------+CM-02 [H] Baseline Configuration – Assessment Procedure
------+CM-02(02) [H] Automation Support for Accuracy and Currency – Assessment Procedure
------+CM-02(03) [H] Retention of Previous Configurations – Assessment Procedure
------+CM-02(07) [H] Configure Systems and Components for High-risk Areas – Assessment Procedure
------+CM-03 [H] Configuration Change Control – Assessment Procedure
------+CM-03(01) [H] Automated Documentation, Notification, and Prohibition of Changes – Assessment Procedure
------+CM-03(02) [H] Testing, Validation, and Documentation of Changes – Assessment Procedure
------+CM-03(04) [H] Security and Privacy Representatives – Assessment Procedure
------+CM-03(06) [H] Cryptography Management – Assessment Procedure
------+CM-04 [H] Impact Analyses – Assessment Procedure
------+CM-04(01) [H] Separate Test Environments – Assessment Procedure
------+CM-04(02) [H] Verification of Controls – Assessment Procedure
------+CM-05 [H] Access Restrictions for Change – Assessment Procedure
------+CM-05(01) [H] Automated Access Enforcement and Audit Records – Assessment Procedure
------+CM-06 [H] Configuration Settings – Assessment Procedure
------+CM-06(01) [H] Automated Management, Application, and Verification – Assessment Procedure
------+CM-06(02) [H] Respond to Unauthorized Changes – Assessment Procedure
------+CM-07 [H] Least Functionality – Assessment Procedure
------+CM-07(01) [H] Periodic Review – Assessment Procedure
------+CM-07(02) [H] Prevent Program Execution – Assessment Procedure
------+CM-07(05) [H] Authorized Software — Allow-by-exception – Assessment Procedure
------+CM-08 [H] System Component Inventory – Assessment Procedure
------+CM-08(01) [H] Updates During Installation and Removal – Assessment Procedure
------+CM-08(02) [H] Automated Maintenance – Assessment Procedure
------+CM-08(03) [H] Automated Unauthorized Component Detection – Assessment Procedure
------+CM-08(04) [H] Accountability Information – Assessment Procedure
------+CM-09 [H] Configuration Management Plan – Assessment Procedure
------+CM-10 [H] Software Usage Restrictions – Assessment Procedure
------+CM-11 [H] User-installed Software – Assessment Procedure
------+CM-12 [H] Information Location – Assessment Procedure
------+CM-12(01) [H] Automated Tools to Support Information Location – Assessment Procedure
------+CP-01 [H] Policy and Procedures – Assessment Procedure
------+CP-02 [H] Contingency Plan – Assessment Procedure
------+CP-02(01) [H] Coordinate with Related Plans – Assessment Procedure
------+CP-02(02) [H] Capacity Planning – Assessment Procedure
------+CP-02(03) [H] Resume Mission and Business Functions – Assessment Procedure
------+CP-02(05) [H] Continue Mission and Business Functions – Assessment Procedure
------+CP-02(08) [H] Identify Critical Assets – Assessment Procedure
------+CP-03 [H] Contingency Training – Assessment Procedure
------+CP-03(01) [H] Simulated Events – Assessment Procedure
------+CP-04 [H] Contingency Plan Testing – Assessment Procedure
------+CP-04(01) [H] Coordinate with Related Plans – Assessment Procedure
------+CP-04(02) [H] Alternate Processing Site – Assessment Procedure
------+CP-06 [H] Alternate Storage Site – Assessment Procedure
------+CP-06(01) [H] Separation from Primary Site – Assessment Procedure
------+CP-06(02) [H] Recovery Time and Recovery Point Objectives – Assessment Procedure
------+CP-06(03) [H] Accessibility – Assessment Procedure
------+CP-07 [H] Alternate Processing Site – Assessment Procedure
------+CP-07(01) [H] Separation from Primary Site – Assessment Procedure
------+CP-07(02) [H] Accessibility – Assessment Procedure
------+CP-07(03) [H] Priority of Service – Assessment Procedure
------+CP-07(04) [H] Preparation for Use – Assessment Procedure
------+CP-08 [H] Telecommunications Services – Assessment Procedure
------+CP-08(01) [H] Priority of Service Provisions – Assessment Procedure
------+CP-08(02) [H] Single Points of Failure – Assessment Procedure
------+CP-08(03) [H] Separation of Primary and Alternate Providers – Assessment Procedure
------+CP-08(04) [H] Provider Contingency Plan – Assessment Procedure
------+CP-09 [H] System Backup – Assessment Procedure
------+CP-09(01) [H] Testing for Reliability and Integrity – Assessment Procedure
------+CP-09(02) [H] Test Restoration Using Sampling – Assessment Procedure
------+CP-09(03) [H] Separate Storage for Critical Information – Assessment Procedure
------+CP-09(05) [H] Transfer to Alternate Storage Site – Assessment Procedure
------+CP-09(08) [H] Cryptographic Protection – Assessment Procedure
------+CP-10 [H] System Recovery and Reconstitution – Assessment Procedure
------+CP-10(02) [H] Transaction Recovery – Assessment Procedure
------+CP-10(04) [H] Restore Within Time Period – Assessment Procedure
------+IA-01 [H] Policy and Procedures – Assessment Procedure
------+IA-02 [H] Identification and Authentication (Organizational Users) – Assessment Procedure
------+IA-02(01) [H] Multi-factor Authentication to Privileged Accounts – Assessment Procedure
------+IA-02(02) [H] Multi-factor Authentication to Non-privileged Accounts – Assessment Procedure
------+IA-02(05) [H] Individual Authentication with Group Authentication – Assessment Procedure
------+IA-02(08) [H] Access to Accounts — Replay Resistant – Assessment Procedure
------+IA-02(12) [H] Acceptance of PIV Credentials – Assessment Procedure
------+IA-03 [H] Device Identification and Authentication – Assessment Procedure
------+IA-04 [H] Identifier Management – Assessment Procedure
------+IA-04(04) [H] Identify User Status – Assessment Procedure
------+IA-05 [H] Authenticator Management – Assessment Procedure
------+IA-05(01) [H] Password-based Authentication – Assessment Procedure
------+IA-05(02) [H] Public Key-based Authentication – Assessment Procedure
------+IA-05(06) [H] Protection of Authenticators – Assessment Procedure
------+IA-06 [H] Authentication Feedback – Assessment Procedure
------+IA-07 [H] Cryptographic Module Authentication – Assessment Procedure
------+IA-08 [H] Identification and Authentication (Non-organizational Users) – Assessment Procedure
------+IA-08(01) [H] Acceptance of PIV Credentials from Other Agencies – Assessment Procedure
------+IA-08(02) [H] Acceptance of External Authenticators – Assessment Procedure
------+IA-08(04) [H] Use of Defined Profiles – Assessment Procedure
------+IA-11 [H] Re-authentication – Assessment Procedure
------+IA-12 [H] Identity Proofing – Assessment Procedure
------+IA-12(02) [H] Identity Evidence – Assessment Procedure
------+IA-12(03) [H] Identity Evidence Validation and Verification – Assessment Procedure
------+IA-12(04) [H] In-person Validation and Verification – Assessment Procedure
------+IA-12(05) [H] Address Confirmation – Assessment Procedure
------+IR-01 [H] Policy and Procedures – Assessment Procedure
------+IR-02 [H] Incident Response Training – Assessment Procedure
------+IR-02(01) [H] Simulated Events – Assessment Procedure
------+IR-02(02) [H] Automated Training Environments – Assessment Procedure
------+IR-03 [H] Incident Response Testing – Assessment Procedure
------+IR-03(02) [H] Coordination with Related Plans – Assessment Procedure
------+IR-04 [H] Incident Handling – Assessment Procedure
------+IR-04(01) [H] Automated Incident Handling Processes – Assessment Procedure
------+IR-04(04) [H] Information Correlation – Assessment Procedure
------+IR-04(11) [H] Integrated Incident Response Team – Assessment Procedure
------+IR-05 [H] Incident Monitoring – Assessment Procedure
------+IR-05(01) [H] Automated Tracking, Data Collection, and Analysis – Assessment Procedure
------+IR-06 [H] Incident Reporting – Assessment Procedure
------+IR-06(01) [H] Automated Reporting – Assessment Procedure
------+IR-06(03) [H] Supply Chain Coordination – Assessment Procedure
------+IR-07 [H] Incident Response Assistance – Assessment Procedure
------+IR-07(01) [H] Automation Support for Availability of Information and Support – Assessment Procedure
------+IR-08 [H] Incident Response Plan – Assessment Procedure
------+MA-01 [H] Policy and Procedures – Assessment Procedure
------+MA-02 [H] Controlled Maintenance – Assessment Procedure
------+MA-02(02) [H] Automated Maintenance Activities – Assessment Procedure
------+MA-03 [H] Maintenance Tools – Assessment Procedure
------+MA-03(01) [H] Inspect Tools – Assessment Procedure
------+MA-03(02) [H] Inspect Media – Assessment Procedure
------+MA-03(03) [H] Prevent Unauthorized Removal – Assessment Procedure
------+MA-04 [H] Nonlocal Maintenance – Assessment Procedure
------+MA-04(03) [H] Comparable Security and Sanitization – Assessment Procedure
------+MA-05 [H] Maintenance Personnel – Assessment Procedure
------+MA-05(01) [H] Individuals Without Appropriate Access – Assessment Procedure
------+MA-06 [H] Timely Maintenance – Assessment Procedure
------+MP-01 [H] Policy and Procedures – Assessment Procedure
------+MP-02 [H] Media Access – Assessment Procedure
------+MP-03 [H] Media Marking – Assessment Procedure
------+MP-04 [H] Media Storage – Assessment Procedure
------+MP-05 [H] Media Transport – Assessment Procedure
------+MP-06 [H] Media Sanitization – Assessment Procedure
------+MP-06(01) [H] Review, Approve, Track, Document, and Verify – Assessment Procedure
------+MP-06(02) [H] Equipment Testing – Assessment Procedure
------+MP-06(03) [H] Nondestructive Techniques – Assessment Procedure
------+MP-07 [H] Media Use – Assessment Procedure
------+PE-01 [H] Policy and Procedures – Assessment Procedure
------+PE-02 [H] Physical Access Authorizations – Assessment Procedure
------+PE-03 [H] Physical Access Control – Assessment Procedure
------+PE-03(01) [H] System Access – Assessment Procedure
------+PE-04 [H] Access Control for Transmission – Assessment Procedure
------+PE-05 [H] Access Control for Output Devices – Assessment Procedure
------+PE-06 [H] Monitoring Physical Access – Assessment Procedure
------+PE-06(01) [H] Intrusion Alarms and Surveillance Equipment – Assessment Procedure
------+PE-06(04) [H] Monitoring Physical Access to Systems – Assessment Procedure
------+PE-08 [H] Visitor Access Records – Assessment Procedure
------+PE-08(01) [H] Automated Records Maintenance and Review – Assessment Procedure
------+PE-09 [H] Power Equipment and Cabling – Assessment Procedure
------+PE-10 [H] Emergency Shutoff – Assessment Procedure
------+PE-11 [H] Emergency Power – Assessment Procedure
------+PE-11(01) [H] Alternate Power Supply — Minimal Operational Capability – Assessment Procedure
------+PE-12 [H] Emergency Lighting – Assessment Procedure
------+PE-13 [H] Fire Protection – Assessment Procedure
------+PE-13(01) [H] Detection Systems — Automatic Activation and Notification – Assessment Procedure
------+PE-13(02) [H] Suppression Systems — Automatic Activation and Notification – Assessment Procedure
------+PE-14 [H] Environmental Controls – Assessment Procedure
------+PE-15 [H] Water Damage Protection – Assessment Procedure
------+PE-15(01) [H] Automation Support – Assessment Procedure
------+PE-16 [H] Delivery and Removal – Assessment Procedure
------+PE-17 [H] Alternate Work Site – Assessment Procedure
------+PE-18 [H] Location of System Components – Assessment Procedure
------+PL-01 [H] Policy and Procedures – Assessment Procedure
------+PL-02 [H] System Security and Privacy Plans – Assessment Procedure
------+PL-04 [H] Rules of Behavior – Assessment Procedure
------+PL-04(01) [H] Social Media and External Site/Application Usage Restrictions – Assessment Procedure
------+PL-08 [H] Security and Privacy Architectures – Assessment Procedure
------+PL-10 [H] Baseline Selection – Assessment Procedure
------+PL-11 [H] Baseline Tailoring – Assessment Procedure
------+PS-01 [H] Policy and Procedures – Assessment Procedure
------+PS-02 [H] Position Risk Designation – Assessment Procedure
------+PS-03 [H] Personnel Screening – Assessment Procedure
------+PS-04 [H] Personnel Termination – Assessment Procedure
------+PS-04(02) [H] Automated Actions – Assessment Procedure
------+PS-05 [H] Personnel Transfer – Assessment Procedure
------+PS-06 [H] Access Agreements – Assessment Procedure
------+PS-07 [H] External Personnel Security – Assessment Procedure
------+PS-08 [H] Personnel Sanctions – Assessment Procedure
------+PS-09 [H] Position Descriptions – Assessment Procedure
------+RA-01 [H] Policy and Procedures – Assessment Procedure
------+RA-02 [H] Security Categorization – Assessment Procedure
------+RA-03 [H] Risk Assessment – Assessment Procedure
------+RA-03(01) [H] Supply Chain Risk Assessment – Assessment Procedure
------+RA-05 [H] Vulnerability Monitoring and Scanning – Assessment Procedure
------+RA-05(02) [H] Update Vulnerabilities to Be Scanned – Assessment Procedure
------+RA-05(04) [H] Discoverable Information – Assessment Procedure
------+RA-05(05) [H] Privileged Access – Assessment Procedure
------+RA-05(11) [H] Public Disclosure Program – Assessment Procedure
------+RA-07 [H] Risk Response – Assessment Procedure
------+RA-09 [H] Criticality Analysis – Assessment Procedure
------+SA-01 [H] Policy and Procedures – Assessment Procedure
------+SA-02 [H] Allocation of Resources – Assessment Procedure
------+SA-03 [H] System Development Life Cycle – Assessment Procedure
------+SA-04 [H] Acquisition Process – Assessment Procedure
------+SA-04(01) [H] Functional Properties of Controls – Assessment Procedure
------+SA-04(02) [H] Design and Implementation Information for Controls – Assessment Procedure
------+SA-04(05) [H] System, Component, and Service Configurations – Assessment Procedure
------+SA-04(09) [H] Functions, Ports, Protocols, and Services in Use – Assessment Procedure
------+SA-04(10) [H] Use of Approved PIV Products – Assessment Procedure
------+SA-05 [H] System Documentation – Assessment Procedure
------+SA-08 [H] Security and Privacy Engineering Principles – Assessment Procedure
------+SA-09 [H] External System Services – Assessment Procedure
------+SA-09(02) [H] Identification of Functions, Ports, Protocols, and Services – Assessment Procedure
------+SA-10 [H] Developer Configuration Management – Assessment Procedure
------+SA-11 [H] Developer Testing and Evaluation – Assessment Procedure
------+SA-15 [H] Development Process, Standards, and Tools – Assessment Procedure
------+SA-15(03) [H] Criticality Analysis – Assessment Procedure
------+SA-16 [H] Developer-provided Training – Assessment Procedure
------+SA-17 [H] Developer Security and Privacy Architecture and Design – Assessment Procedure
------+SA-21 [H] Developer Screening – Assessment Procedure
------+SA-22 [H] Unsupported System Components – Assessment Procedure
------+SC-01 [H] Policy and Procedures – Assessment Procedure
------+SC-02 [H] Separation of System and User Functionality – Assessment Procedure
------+SC-03 [H] Security Function Isolation – Assessment Procedure
------+SC-04 [H] Information in Shared System Resources – Assessment Procedure
------+SC-05 [H] Denial-of-service Protection – Assessment Procedure
------+SC-07 [H] Boundary Protection – Assessment Procedure
------+SC-07(03) [H] Access Points – Assessment Procedure
------+SC-07(04) [H] External Telecommunications Services – Assessment Procedure
------+SC-07(05) [H] Deny by Default — Allow by Exception – Assessment Procedure
------+SC-07(07) [H] Split Tunneling for Remote Devices – Assessment Procedure
------+SC-07(08) [H] Route Traffic to Authenticated Proxy Servers – Assessment Procedure
------+SC-07(18) [H] Fail Secure – Assessment Procedure
------+SC-07(21) [H] Isolation of System Components – Assessment Procedure
------+SC-08 [H] Transmission Confidentiality and Integrity – Assessment Procedure
------+SC-08(01) [H] Cryptographic Protection – Assessment Procedure
------+SC-10 [H] Network Disconnect – Assessment Procedure
------+SC-12 [H] Cryptographic Key Establishment and Management – Assessment Procedure
------+SC-12(01) [H] Availability – Assessment Procedure
------+SC-13 [H] Cryptographic Protection – Assessment Procedure
------+SC-15 [H] Collaborative Computing Devices and Applications – Assessment Procedure
------+SC-17 [H] Public Key Infrastructure Certificates – Assessment Procedure
------+SC-18 [H] Mobile Code – Assessment Procedure
------+SC-20 [H] Secure Name/Address Resolution Service (Authoritative Source) – Assessment Procedure
------+SC-21 [H] Secure Name/Address Resolution Service (Recursive or Caching Resolver) – Assessment Procedure
------+SC-22 [H] Architecture and Provisioning for Name/Address Resolution Service – Assessment Procedure
------+SC-23 [H] Session Authenticity – Assessment Procedure
------+SC-24 [H] Fail in Known State – Assessment Procedure
------+SC-28 [H] Protection of Information at Rest – Assessment Procedure
------+SC-28(01) [H] Cryptographic Protection – Assessment Procedure
------+SC-39 [H] Process Isolation – Assessment Procedure
------+SI-01 [H] Policy and Procedures – Assessment Procedure
------+SI-02 [H] Flaw Remediation – Assessment Procedure
------+SI-02(02) [H] Automated Flaw Remediation Status – Assessment Procedure
------+SI-03 [H] Malicious Code Protection – Assessment Procedure
------+SI-04 [H] System Monitoring – Assessment Procedure
------+SI-04(02) [H] Automated Tools and Mechanisms for Real-time Analysis – Assessment Procedure
------+SI-04(04) [H] Inbound and Outbound Communications Traffic – Assessment Procedure
------+SI-04(05) [H] System-generated Alerts – Assessment Procedure
------+SI-04(10) [H] Visibility of Encrypted Communications – Assessment Procedure
------+SI-04(12) [H] Automated Organization-generated Alerts – Assessment Procedure
------+SI-04(14) [H] Wireless Intrusion Detection – Assessment Procedure
------+SI-04(20) [H] Privileged Users – Assessment Procedure
------+SI-04(22) [H] Unauthorized Network Services – Assessment Procedure
------+SI-05 [H] Security Alerts, Advisories, and Directives – Assessment Procedure
------+SI-05(01) [H] Automated Alerts and Advisories – Assessment Procedure
------+SI-06 [H] Security and Privacy Function Verification – Assessment Procedure
------+SI-07 [H] Software, Firmware, and Information Integrity – Assessment Procedure
------+SI-07(01) [H] Integrity Checks – Assessment Procedure
------+SI-07(02) [H] Automated Notifications of Integrity Violations – Assessment Procedure
------+SI-07(05) [H] Automated Response to Integrity Violations – Assessment Procedure
------+SI-07(07) [H] Integration of Detection and Response – Assessment Procedure
------+SI-07(15) [H] Code Authentication – Assessment Procedure
------+SI-08 [H] Spam Protection – Assessment Procedure
------+SI-08(02) [H] Automatic Updates – Assessment Procedure
------+SI-10 [H] Information Input Validation – Assessment Procedure
------+SI-11 [H] Error Handling – Assessment Procedure
------+SI-12 [H] Information Management and Retention – Assessment Procedure
------+SI-16 [H] Memory Protection – Assessment Procedure
------+SR-01 [H] Policy and Procedures – Assessment Procedure
------+SR-02 [H] Supply Chain Risk Management Plan – Assessment Procedure
------+SR-02(01) [H] Establish SCRM Team – Assessment Procedure
------+SR-03 [H] Supply Chain Controls and Processes – Assessment Procedure
------+SR-05 [H] Acquisition Strategies, Tools, and Methods – Assessment Procedure
------+SR-06 [H] Supplier Assessments and Reviews – Assessment Procedure
------+SR-08 [H] Notification Agreements – Assessment Procedure
------+SR-09 [H] Tamper Resistance and Detection – Assessment Procedure
------+SR-09(01) [H] Multiple Stages of System Development Life Cycle – Assessment Procedure
------+SR-10 [H] Inspection of Systems or Components – Assessment Procedure
------+SR-11 [H] Component Authenticity – Assessment Procedure
------+SR-11(01) [H] Anti-counterfeit Training – Assessment Procedure
------+SR-11(02) [H] Configuration Control for Component Service and Repair – Assessment Procedure
------+SR-12 [H] Component Disposal – Assessment Procedure

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.1.1 HIGH IMPACT BASELINE

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.1.1 HIGH IMPACT BASELINE

1. Forbhreathnú

AC [H] Access Control Access Control
AT [H] Awareness and Training Awareness and Training
AU [H] Audit and Accountability Audit and Accountability
CA [H] Assessment, Authorization, and Monitoring Assessment, Authorization, and Monitoring
CM [H] Configuration Management Configuration Management
CP [H] Contingency Planning Contingency Planning
IA [H] Identification and Authentication Identification and Authentication
IR [H] Incident Response Incident Response
MA [H] Maintenance Maintenance
MP [H] Media Protection Media Protection
PE [H] Physical and Environmental Protection Physical and Environmental Protection
PL [H] Planning Planning
PS [H] Personnel Security Personnel Security
RA [H] Risk Assessment Risk Assessment
SA [H] System and Services Acquisition System and Services Acquisition
SC [H] System and Communications Protection System and Communications Protection
SI [H] System and Information Integrity System and Information Integrity
SR [H] Supply Chain Risk Management Supply Chain Risk Management

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Rialacháin ghaolmhara

Rialacháin

Saincheisteanna nasctha

Naisc
is related to English
is related to Information Security
is related to New version: NIST SP 800-53 Rev. 5 HIGH Baseline (v1.5.0-4fbdb82960) – 182 new, 0 changed, 0 removed
is related to New version: NIST SP 800-53 Rev. 5 HIGH Baseline (v1.5.0-4fbdb82960) – 371 new, 0 changed, 0 removed, 370 links
includes NIST SP 800-53 Rev. 5 HIGH Baseline – Assessment Procedures