+Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 LOW IMPACT BASELINE
---+AC [L] Access Control
------+AC-01 [L] Policy and Procedures
------+AC-02 [L] Account Management
------+AC-03 [L] Access Enforcement
------+AC-07 [L] Unsuccessful Logon Attempts
------+AC-08 [L] System Use Notification
------+AC-14 [L] Permitted Actions Without Identification or Authentication
------+AC-17 [L] Remote Access
------+AC-18 [L] Wireless Access
------+AC-19 [L] Access Control for Mobile Devices
------+AC-20 [L] Use of External Systems
------+AC-22 [L] Publicly Accessible Content
---+AT [L] Awareness and Training
------+AT-01 [L] Policy and Procedures
------+AT-02 [L] Literacy Training and Awareness
---------+AT-02(02) [L] Insider Threat
------+AT-03 [L] Role-based Training
------+AT-04 [L] Training Records
---+AU [L] Audit and Accountability
------+AU-01 [L] Policy and Procedures
------+AU-02 [L] Event Logging
------+AU-03 [L] Content of Audit Records
------+AU-04 [L] Audit Log Storage Capacity
------+AU-05 [L] Response to Audit Logging Process Failures
------+AU-06 [L] Audit Record Review, Analysis, and Reporting
------+AU-08 [L] Time Stamps
------+AU-09 [L] Protection of Audit Information
------+AU-11 [L] Audit Record Retention
------+AU-12 [L] Audit Record Generation
---+CA [L] Assessment, Authorization, and Monitoring
------+CA-01 [L] Policy and Procedures
------+CA-02 [L] Control Assessments
------+CA-03 [L] Information Exchange
------+CA-05 [L] Plan of Action and Milestones
------+CA-06 [L] Authorization
------+CA-07 [L] Continuous Monitoring
---------+CA-07(04) [L] Risk Monitoring
------+CA-09 [L] Internal System Connections
---+CM [L] Configuration Management
------+CM-01 [L] Policy and Procedures
------+CM-02 [L] Baseline Configuration
------+CM-04 [L] Impact Analyses
------+CM-05 [L] Access Restrictions for Change
------+CM-06 [L] Configuration Settings
------+CM-07 [L] Least Functionality
------+CM-08 [L] System Component Inventory
------+CM-10 [L] Software Usage Restrictions
------+CM-11 [L] User-installed Software
---+CP [L] Contingency Planning
------+CP-01 [L] Policy and Procedures
------+CP-02 [L] Contingency Plan
------+CP-03 [L] Contingency Training
------+CP-04 [L] Contingency Plan Testing
------+CP-09 [L] System Backup
------+CP-10 [L] System Recovery and Reconstitution
---+IA [L] Identification and Authentication
------+IA-01 [L] Policy and Procedures
------+IA-02 [L] Identification and Authentication (Organizational Users)
---------+IA-02(01) [L] Multi-factor Authentication to Privileged Accounts
---------+IA-02(02) [L] Multi-factor Authentication to Non-privileged Accounts
---------+IA-02(08) [L] Access to Accounts — Replay Resistant
---------+IA-02(12) [L] Acceptance of PIV Credentials
------+IA-04 [L] Identifier Management
------+IA-05 [L] Authenticator Management
---------+IA-05(01) [L] Password-based Authentication
------+IA-06 [L] Authentication Feedback
------+IA-07 [L] Cryptographic Module Authentication
------+IA-08 [L] Identification and Authentication (Non-organizational Users)
---------+IA-08(01) [L] Acceptance of PIV Credentials from Other Agencies
---------+IA-08(02) [L] Acceptance of External Authenticators
---------+IA-08(04) [L] Use of Defined Profiles
------+IA-11 [L] Re-authentication
---+IR [L] Incident Response
------+IR-01 [L] Policy and Procedures
------+IR-02 [L] Incident Response Training
------+IR-04 [L] Incident Handling
------+IR-05 [L] Incident Monitoring
------+IR-06 [L] Incident Reporting
------+IR-07 [L] Incident Response Assistance
------+IR-08 [L] Incident Response Plan
---+MA [L] Maintenance
------+MA-01 [L] Policy and Procedures
------+MA-02 [L] Controlled Maintenance
------+MA-04 [L] Nonlocal Maintenance
------+MA-05 [L] Maintenance Personnel
---+MP [L] Media Protection
------+MP-01 [L] Policy and Procedures
------+MP-02 [L] Media Access
------+MP-06 [L] Media Sanitization
------+MP-07 [L] Media Use
---+PE [L] Physical and Environmental Protection
------+PE-01 [L] Policy and Procedures
------+PE-02 [L] Physical Access Authorizations
------+PE-03 [L] Physical Access Control
------+PE-06 [L] Monitoring Physical Access
------+PE-08 [L] Visitor Access Records
------+PE-12 [L] Emergency Lighting
------+PE-13 [L] Fire Protection
------+PE-14 [L] Environmental Controls
------+PE-15 [L] Water Damage Protection
------+PE-16 [L] Delivery and Removal
---+PL [L] Planning
------+PL-01 [L] Policy and Procedures
------+PL-02 [L] System Security and Privacy Plans
------+PL-04 [L] Rules of Behavior
---------+PL-04(01) [L] Social Media and External Site/Application Usage Restrictions
------+PL-10 [L] Baseline Selection
------+PL-11 [L] Baseline Tailoring
---+PS [L] Personnel Security
------+PS-01 [L] Policy and Procedures
------+PS-02 [L] Position Risk Designation
------+PS-03 [L] Personnel Screening
------+PS-04 [L] Personnel Termination
------+PS-05 [L] Personnel Transfer
------+PS-06 [L] Access Agreements
------+PS-07 [L] External Personnel Security
------+PS-08 [L] Personnel Sanctions
------+PS-09 [L] Position Descriptions
---+RA [L] Risk Assessment
------+RA-01 [L] Policy and Procedures
------+RA-02 [L] Security Categorization
------+RA-03 [L] Risk Assessment
---------+RA-03(01) [L] Supply Chain Risk Assessment
------+RA-05 [L] Vulnerability Monitoring and Scanning
---------+RA-05(02) [L] Update Vulnerabilities to Be Scanned
---------+RA-05(11) [L] Public Disclosure Program
------+RA-07 [L] Risk Response
---+SA [L] System and Services Acquisition
------+SA-01 [L] Policy and Procedures
------+SA-02 [L] Allocation of Resources
------+SA-03 [L] System Development Life Cycle
------+SA-04 [L] Acquisition Process
---------+SA-04(10) [L] Use of Approved PIV Products
------+SA-05 [L] System Documentation
------+SA-08 [L] Security and Privacy Engineering Principles
------+SA-09 [L] External System Services
------+SA-22 [L] Unsupported System Components
---+SC [L] System and Communications Protection
------+SC-01 [L] Policy and Procedures
------+SC-05 [L] Denial-of-service Protection
------+SC-07 [L] Boundary Protection
------+SC-12 [L] Cryptographic Key Establishment and Management
------+SC-13 [L] Cryptographic Protection
------+SC-15 [L] Collaborative Computing Devices and Applications
------+SC-20 [L] Secure Name/Address Resolution Service (Authoritative Source)
------+SC-21 [L] Secure Name/Address Resolution Service (Recursive or Caching Resolver)
------+SC-22 [L] Architecture and Provisioning for Name/Address Resolution Service
------+SC-39 [L] Process Isolation
---+SI [L] System and Information Integrity
------+SI-01 [L] Policy and Procedures
------+SI-02 [L] Flaw Remediation
------+SI-03 [L] Malicious Code Protection
------+SI-04 [L] System Monitoring
------+SI-05 [L] Security Alerts, Advisories, and Directives
------+SI-12 [L] Information Management and Retention
---+SR [L] Supply Chain Risk Management
------+SR-01 [L] Policy and Procedures
------+SR-02 [L] Supply Chain Risk Management Plan
---------+SR-02(01) [L] Establish SCRM Team
------+SR-03 [L] Supply Chain Controls and Processes
------+SR-05 [L] Acquisition Strategies, Tools, and Methods
------+SR-08 [L] Notification Agreements
------+SR-10 [L] Inspection of Systems or Components
------+SR-11 [L] Component Authenticity
---------+SR-11(01) [L] Anti-counterfeit Training
---------+SR-11(02) [L] Configuration Control for Component Service and Repair
------+SR-12 [L] Component Disposal
---+NIST SP 800-53 Rev. 5 LOW Baseline – Assessment Procedures
------+AC-01 [L] Policy and Procedures – Assessment Procedure
------+AC-02 [L] Account Management – Assessment Procedure
------+AC-03 [L] Access Enforcement – Assessment Procedure
------+AC-07 [L] Unsuccessful Logon Attempts – Assessment Procedure
------+AC-08 [L] System Use Notification – Assessment Procedure
------+AC-14 [L] Permitted Actions Without Identification or Authentication – Assessment Procedure
------+AC-17 [L] Remote Access – Assessment Procedure
------+AC-18 [L] Wireless Access – Assessment Procedure
------+AC-19 [L] Access Control for Mobile Devices – Assessment Procedure
------+AC-20 [L] Use of External Systems – Assessment Procedure
------+AC-22 [L] Publicly Accessible Content – Assessment Procedure
------+AT-01 [L] Policy and Procedures – Assessment Procedure
------+AT-02 [L] Literacy Training and Awareness – Assessment Procedure
------+AT-02(02) [L] Insider Threat – Assessment Procedure
------+AT-03 [L] Role-based Training – Assessment Procedure
------+AT-04 [L] Training Records – Assessment Procedure
------+AU-01 [L] Policy and Procedures – Assessment Procedure
------+AU-02 [L] Event Logging – Assessment Procedure
------+AU-03 [L] Content of Audit Records – Assessment Procedure
------+AU-04 [L] Audit Log Storage Capacity – Assessment Procedure
------+AU-05 [L] Response to Audit Logging Process Failures – Assessment Procedure
------+AU-06 [L] Audit Record Review, Analysis, and Reporting – Assessment Procedure
------+AU-08 [L] Time Stamps – Assessment Procedure
------+AU-09 [L] Protection of Audit Information – Assessment Procedure
------+AU-11 [L] Audit Record Retention – Assessment Procedure
------+AU-12 [L] Audit Record Generation – Assessment Procedure
------+CA-01 [L] Policy and Procedures – Assessment Procedure
------+CA-02 [L] Control Assessments – Assessment Procedure
------+CA-03 [L] Information Exchange – Assessment Procedure
------+CA-05 [L] Plan of Action and Milestones – Assessment Procedure
------+CA-06 [L] Authorization – Assessment Procedure
------+CA-07 [L] Continuous Monitoring – Assessment Procedure
------+CA-07(04) [L] Risk Monitoring – Assessment Procedure
------+CA-09 [L] Internal System Connections – Assessment Procedure
------+CM-01 [L] Policy and Procedures – Assessment Procedure
------+CM-02 [L] Baseline Configuration – Assessment Procedure
------+CM-04 [L] Impact Analyses – Assessment Procedure
------+CM-05 [L] Access Restrictions for Change – Assessment Procedure
------+CM-06 [L] Configuration Settings – Assessment Procedure
------+CM-07 [L] Least Functionality – Assessment Procedure
------+CM-08 [L] System Component Inventory – Assessment Procedure
------+CM-10 [L] Software Usage Restrictions – Assessment Procedure
------+CM-11 [L] User-installed Software – Assessment Procedure
------+CP-01 [L] Policy and Procedures – Assessment Procedure
------+CP-02 [L] Contingency Plan – Assessment Procedure
------+CP-03 [L] Contingency Training – Assessment Procedure
------+CP-04 [L] Contingency Plan Testing – Assessment Procedure
------+CP-09 [L] System Backup – Assessment Procedure
------+CP-10 [L] System Recovery and Reconstitution – Assessment Procedure
------+IA-01 [L] Policy and Procedures – Assessment Procedure
------+IA-02 [L] Identification and Authentication (Organizational Users) – Assessment Procedure
------+IA-02(01) [L] Multi-factor Authentication to Privileged Accounts – Assessment Procedure
------+IA-02(02) [L] Multi-factor Authentication to Non-privileged Accounts – Assessment Procedure
------+IA-02(08) [L] Access to Accounts — Replay Resistant – Assessment Procedure
------+IA-02(12) [L] Acceptance of PIV Credentials – Assessment Procedure
------+IA-04 [L] Identifier Management – Assessment Procedure
------+IA-05 [L] Authenticator Management – Assessment Procedure
------+IA-05(01) [L] Password-based Authentication – Assessment Procedure
------+IA-06 [L] Authentication Feedback – Assessment Procedure
------+IA-07 [L] Cryptographic Module Authentication – Assessment Procedure
------+IA-08 [L] Identification and Authentication (Non-organizational Users) – Assessment Procedure
------+IA-08(01) [L] Acceptance of PIV Credentials from Other Agencies – Assessment Procedure
------+IA-08(02) [L] Acceptance of External Authenticators – Assessment Procedure
------+IA-08(04) [L] Use of Defined Profiles – Assessment Procedure
------+IA-11 [L] Re-authentication – Assessment Procedure
------+IR-01 [L] Policy and Procedures – Assessment Procedure
------+IR-02 [L] Incident Response Training – Assessment Procedure
------+IR-04 [L] Incident Handling – Assessment Procedure
------+IR-05 [L] Incident Monitoring – Assessment Procedure
------+IR-06 [L] Incident Reporting – Assessment Procedure
------+IR-07 [L] Incident Response Assistance – Assessment Procedure
------+IR-08 [L] Incident Response Plan – Assessment Procedure
------+MA-01 [L] Policy and Procedures – Assessment Procedure
------+MA-02 [L] Controlled Maintenance – Assessment Procedure
------+MA-04 [L] Nonlocal Maintenance – Assessment Procedure
------+MA-05 [L] Maintenance Personnel – Assessment Procedure
------+MP-01 [L] Policy and Procedures – Assessment Procedure
------+MP-02 [L] Media Access – Assessment Procedure
------+MP-06 [L] Media Sanitization – Assessment Procedure
------+MP-07 [L] Media Use – Assessment Procedure
------+PE-01 [L] Policy and Procedures – Assessment Procedure
------+PE-02 [L] Physical Access Authorizations – Assessment Procedure
------+PE-03 [L] Physical Access Control – Assessment Procedure
------+PE-06 [L] Monitoring Physical Access – Assessment Procedure
------+PE-08 [L] Visitor Access Records – Assessment Procedure
------+PE-12 [L] Emergency Lighting – Assessment Procedure
------+PE-13 [L] Fire Protection – Assessment Procedure
------+PE-14 [L] Environmental Controls – Assessment Procedure
------+PE-15 [L] Water Damage Protection – Assessment Procedure
------+PE-16 [L] Delivery and Removal – Assessment Procedure
------+PL-01 [L] Policy and Procedures – Assessment Procedure
------+PL-02 [L] System Security and Privacy Plans – Assessment Procedure
------+PL-04 [L] Rules of Behavior – Assessment Procedure
------+PL-04(01) [L] Social Media and External Site/Application Usage Restrictions – Assessment Procedure
------+PL-10 [L] Baseline Selection – Assessment Procedure
------+PL-11 [L] Baseline Tailoring – Assessment Procedure
------+PS-01 [L] Policy and Procedures – Assessment Procedure
------+PS-02 [L] Position Risk Designation – Assessment Procedure
------+PS-03 [L] Personnel Screening – Assessment Procedure
------+PS-04 [L] Personnel Termination – Assessment Procedure
------+PS-05 [L] Personnel Transfer – Assessment Procedure
------+PS-06 [L] Access Agreements – Assessment Procedure
------+PS-07 [L] External Personnel Security – Assessment Procedure
------+PS-08 [L] Personnel Sanctions – Assessment Procedure
------+PS-09 [L] Position Descriptions – Assessment Procedure
------+RA-01 [L] Policy and Procedures – Assessment Procedure
------+RA-02 [L] Security Categorization – Assessment Procedure
------+RA-03 [L] Risk Assessment – Assessment Procedure
------+RA-03(01) [L] Supply Chain Risk Assessment – Assessment Procedure
------+RA-05 [L] Vulnerability Monitoring and Scanning – Assessment Procedure
------+RA-05(02) [L] Update Vulnerabilities to Be Scanned – Assessment Procedure
------+RA-05(11) [L] Public Disclosure Program – Assessment Procedure
------+RA-07 [L] Risk Response – Assessment Procedure
------+SA-01 [L] Policy and Procedures – Assessment Procedure
------+SA-02 [L] Allocation of Resources – Assessment Procedure
------+SA-03 [L] System Development Life Cycle – Assessment Procedure
------+SA-04 [L] Acquisition Process – Assessment Procedure
------+SA-04(10) [L] Use of Approved PIV Products – Assessment Procedure
------+SA-05 [L] System Documentation – Assessment Procedure
------+SA-08 [L] Security and Privacy Engineering Principles – Assessment Procedure
------+SA-09 [L] External System Services – Assessment Procedure
------+SA-22 [L] Unsupported System Components – Assessment Procedure
------+SC-01 [L] Policy and Procedures – Assessment Procedure
------+SC-05 [L] Denial-of-service Protection – Assessment Procedure
------+SC-07 [L] Boundary Protection – Assessment Procedure
------+SC-12 [L] Cryptographic Key Establishment and Management – Assessment Procedure
------+SC-13 [L] Cryptographic Protection – Assessment Procedure
------+SC-15 [L] Collaborative Computing Devices and Applications – Assessment Procedure
------+SC-20 [L] Secure Name/Address Resolution Service (Authoritative Source) – Assessment Procedure
------+SC-21 [L] Secure Name/Address Resolution Service (Recursive or Caching Resolver) – Assessment Procedure
------+SC-22 [L] Architecture and Provisioning for Name/Address Resolution Service – Assessment Procedure
------+SC-39 [L] Process Isolation – Assessment Procedure
------+SI-01 [L] Policy and Procedures – Assessment Procedure
------+SI-02 [L] Flaw Remediation – Assessment Procedure
------+SI-03 [L] Malicious Code Protection – Assessment Procedure
------+SI-04 [L] System Monitoring – Assessment Procedure
------+SI-05 [L] Security Alerts, Advisories, and Directives – Assessment Procedure
------+SI-12 [L] Information Management and Retention – Assessment Procedure
------+SR-01 [L] Policy and Procedures – Assessment Procedure
------+SR-02 [L] Supply Chain Risk Management Plan – Assessment Procedure
------+SR-02(01) [L] Establish SCRM Team – Assessment Procedure
------+SR-03 [L] Supply Chain Controls and Processes – Assessment Procedure
------+SR-05 [L] Acquisition Strategies, Tools, and Methods – Assessment Procedure
------+SR-08 [L] Notification Agreements – Assessment Procedure
------+SR-10 [L] Inspection of Systems or Components – Assessment Procedure
------+SR-11 [L] Component Authenticity – Assessment Procedure
------+SR-11(01) [L] Anti-counterfeit Training – Assessment Procedure
------+SR-11(02) [L] Configuration Control for Component Service and Repair – Assessment Procedure
------+SR-12 [L] Component Disposal – Assessment Procedure

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 LOW IMPACT BASELINE

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 LOW IMPACT BASELINE

1. Panoramica

AC [L] Access Control Access Control
AT [L] Awareness and Training Awareness and Training
AU [L] Audit and Accountability Audit and Accountability
CA [L] Assessment, Authorization, and Monitoring Assessment, Authorization, and Monitoring
CM [L] Configuration Management Configuration Management
CP [L] Contingency Planning Contingency Planning
IA [L] Identification and Authentication Identification and Authentication
IR [L] Incident Response Incident Response
MA [L] Maintenance Maintenance
MP [L] Media Protection Media Protection
PE [L] Physical and Environmental Protection Physical and Environmental Protection
PL [L] Planning Planning
PS [L] Personnel Security Personnel Security
RA [L] Risk Assessment Risk Assessment
SA [L] System and Services Acquisition System and Services Acquisition
SC [L] System and Communications Protection System and Communications Protection
SI [L] System and Information Integrity System and Information Integrity
SR [L] Supply Chain Risk Management Supply Chain Risk Management

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is related to English
is related to Information Security
is related to New version: NIST SP 800-53 Rev. 5 LOW Baseline (v1.5.0-941e5bcdce) – 18 new, 0 changed, 0 removed
is related to New version: NIST SP 800-53 Rev. 5 LOW Baseline (v1.5.0-941e5bcdce) – 150 new, 0 changed, 0 removed, 149 links
includes NIST SP 800-53 Rev. 5 LOW Baseline – Assessment Procedures