+Electronic (OSCAL) Version of Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
---+03.01 Access Control
------+03.01.01 Account Management
------+03.01.02 Access Enforcement
------+03.01.03 Information Flow Enforcement
------+03.01.04 Separation of Duties
------+03.01.05 Least Privilege
------+03.01.06 Least Privilege – Privileged Accounts
------+03.01.07 Least Privilege – Privileged Functions
------+03.01.08 Unsuccessful Logon Attempts
------+03.01.09 System Use Notification
------+03.01.10 Device Lock
------+03.01.11 Session Termination
------+03.01.12 Remote Access
------+SP_800_171_03.01.13 03.01.13
------+SP_800_171_03.01.14 03.01.14
------+SP_800_171_03.01.15 03.01.15
------+03.01.16 Wireless Access
------+SP_800_171_03.01.17 03.01.17
------+03.01.18 Access Control for Mobile Devices
------+SP_800_171_03.01.19 03.01.19
------+03.01.20 Use of External Systems
------+SP_800_171_03.01.21 03.01.21
------+03.01.22 Publicly Accessible Content
---+03.02 Awareness and Training
------+03.02.01 Literacy Training and Awareness
------+03.02.02 Role-Based Training
------+SP_800_171_03.02.03 03.02.03
---+03.03 Audit and Accountability
------+03.03.01 Event Logging
------+03.03.02 Audit Record Content
------+03.03.03 Audit Record Generation
------+03.03.04 Response to Audit Logging Process Failures
------+03.03.05 Audit Record Review, Analysis, and Reporting
------+03.03.06 Audit Record Reduction and Report Generation
------+03.03.07 Time Stamps
------+03.03.08 Protection of Audit Information
------+SP_800_171_03.03.09 03.03.09
---+03.04 Configuration Management
------+03.04.01 Baseline Configuration
------+03.04.02 Configuration Settings
------+03.04.03 Configuration Change Control
------+03.04.04 Impact Analyses
------+03.04.05 Access Restrictions for Change
------+03.04.06 Least Functionality
------+SP_800_171_03.04.07 03.04.07
------+03.04.08 Authorized Software – Allow by Exception
------+SP_800_171_03.04.09 03.04.09
------+03.04.10 System Component Inventory
------+03.04.11 Information Location
------+03.04.12 System and Component Configuration for High-Risk Areas
---+03.05 Identification and Authentication
------+03.05.01 User Identification and Authentication
------+03.05.02 Device Identification and Authentication
------+03.05.03 Multi-Factor Authentication
------+03.05.04 Replay-Resistant Authentication
------+03.05.05 Identifier Management
------+SP_800_171_03.05.06 03.05.06
------+03.05.07 Password Management
------+SP_800_171_03.05.08 03.05.08
------+SP_800_171_03.05.09 03.05.09
------+SP_800_171_03.05.10 03.05.10
------+03.05.11 Authentication Feedback
------+03.05.12 Authenticator Management
---+03.06 Incident Response
------+03.06.01 Incident Handling
------+03.06.02 Incident Monitoring, Reporting, and Response Assistance
------+03.06.03 Incident Response Testing
------+03.06.04 Incident Response Training
------+03.06.05 Incident Response Plan
---+03.07 Maintenance
------+SP_800_171_03.07.01 03.07.01
------+SP_800_171_03.07.02 03.07.02
------+SP_800_171_03.07.03 03.07.03
------+03.07.04 Maintenance Tools
------+03.07.05 Nonlocal Maintenance
------+03.07.06 Maintenance Personnel
---+03.08 Media Protection
------+03.08.01 Media Storage
------+03.08.02 Media Access
------+03.08.03 Media Sanitization
------+03.08.04 Media Marking
------+03.08.05 Media Transport
------+SP_800_171_03.08.06 03.08.06
------+03.08.07 Media Use
------+SP_800_171_03.08.08 03.08.08
------+03.08.09 System Backup – Cryptographic Protection
---+03.09 Personnel Security
------+03.09.01 Personnel Screening
------+03.09.02 Personnel Termination and Transfer
---+03.10 Physical Protection
------+03.10.01 Physical Access Authorizations
------+03.10.02 Monitoring Physical Access
------+SP_800_171_03.10.03 03.10.03
------+SP_800_171_03.10.04 03.10.04
------+SP_800_171_03.10.05 03.10.05
------+03.10.06 Alternate Work Site
------+03.10.07 Physical Access Control
------+03.10.08 Access Control for Transmission
---+03.11 Risk Assessment
------+03.11.01 Risk Assessment
------+03.11.02 Vulnerability Monitoring and Scanning
------+SP_800_171_03.11.03 03.11.03
------+03.11.04 Risk Response
---+03.12 Security Assessment and Monitoring
------+03.12.01 Security Assessment
------+03.12.02 Plan of Action and Milestones
------+03.12.03 Continuous Monitoring
------+SP_800_171_03.12.04 03.12.04
------+03.12.05 Information Exchange
---+03.13 System and Communications Protection
------+03.13.01 Boundary Protection
------+SP_800_171_03.13.02 03.13.02
------+SP_800_171_03.13.03 03.13.03
------+03.13.04 Information in Shared System Resources
------+SP_800_171_03.13.05 03.13.05
------+03.13.06 Network Communications – Deny by Default – Allow by Exception
------+SP_800_171_03.13.07 03.13.07
------+03.13.08 Transmission and Storage Confidentiality
------+03.13.09 Network Disconnect
------+03.13.10 Cryptographic Key Establishment and Management
------+03.13.11 Cryptographic Protection
------+03.13.12 Collaborative Computing Devices and Applications
------+03.13.13 Mobile Code
------+SP_800_171_03.13.14 03.13.14
------+03.13.15 Session Authenticity
------+SP_800_171_03.13.16 03.13.16
---+03.14 System and Information Integrity
------+03.14.01 Flaw Remediation
------+03.14.02 Malicious Code Protection
------+03.14.03 Security Alerts, Advisories, and Directives
------+SP_800_171_03.14.04 03.14.04
------+SP_800_171_03.14.05 03.14.05
------+03.14.06 System Monitoring
------+SP_800_171_03.14.07 03.14.07
------+03.14.08 Information Management and Retention
---+03.15 Planning
------+03.15.01 Policy and Procedures
------+03.15.02 System Security Plan
------+03.15.03 Rules of Behavior
---+03.16 System and Services Acquisition
------+03.16.01 Security Engineering Principles
------+03.16.02 Unsupported System Components
------+03.16.03 External System Services
---+03.17 Supply Chain Risk Management
------+03.17.01 Supply Chain Risk Management Plan
------+03.17.02 Acquisition Strategies, Tools, and Methods
------+03.17.03 Supply Chain Requirements and Processes
---+NIST SP 800-171 Rev. 3 – Assessment Procedures
------+03.01.01 Account Management – Assessment Procedure
------+03.01.02 Access Enforcement – Assessment Procedure
------+03.01.03 Information Flow Enforcement – Assessment Procedure
------+03.01.04 Separation of Duties – Assessment Procedure
------+03.01.05 Least Privilege – Assessment Procedure
------+03.01.06 Least Privilege – Privileged Accounts – Assessment Procedure
------+03.01.07 Least Privilege – Privileged Functions – Assessment Procedure
------+03.01.08 Unsuccessful Logon Attempts – Assessment Procedure
------+03.01.09 System Use Notification – Assessment Procedure
------+03.01.10 Device Lock – Assessment Procedure
------+03.01.11 Session Termination – Assessment Procedure
------+03.01.12 Remote Access – Assessment Procedure
------+03.01.16 Wireless Access – Assessment Procedure
------+03.01.18 Access Control for Mobile Devices – Assessment Procedure
------+03.01.20 Use of External Systems – Assessment Procedure
------+03.01.22 Publicly Accessible Content – Assessment Procedure
------+03.02.01 Literacy Training and Awareness – Assessment Procedure
------+03.02.02 Role-Based Training – Assessment Procedure
------+03.03.01 Event Logging – Assessment Procedure
------+03.03.02 Audit Record Content – Assessment Procedure
------+03.03.03 Audit Record Generation – Assessment Procedure
------+03.03.04 Response to Audit Logging Process Failures – Assessment Procedure
------+03.03.05 Audit Record Review, Analysis, and Reporting – Assessment Procedure
------+03.03.06 Audit Record Reduction and Report Generation – Assessment Procedure
------+03.03.07 Time Stamps – Assessment Procedure
------+03.03.08 Protection of Audit Information – Assessment Procedure
------+03.04.01 Baseline Configuration – Assessment Procedure
------+03.04.02 Configuration Settings – Assessment Procedure
------+03.04.03 Configuration Change Control – Assessment Procedure
------+03.04.04 Impact Analyses – Assessment Procedure
------+03.04.05 Access Restrictions for Change – Assessment Procedure
------+03.04.06 Least Functionality – Assessment Procedure
------+03.04.08 Authorized Software – Allow by Exception – Assessment Procedure
------+03.04.10 System Component Inventory – Assessment Procedure
------+03.04.11 Information Location – Assessment Procedure
------+03.04.12 System and Component Configuration for High-Risk Areas – Assessment Procedure
------+03.05.01 User Identification and Authentication – Assessment Procedure
------+03.05.02 Device Identification and Authentication – Assessment Procedure
------+03.05.03 Multi-Factor Authentication – Assessment Procedure
------+03.05.04 Replay-Resistant Authentication – Assessment Procedure
------+03.05.05 Identifier Management – Assessment Procedure
------+03.05.07 Password Management – Assessment Procedure
------+03.05.11 Authentication Feedback – Assessment Procedure
------+03.05.12 Authenticator Management – Assessment Procedure
------+03.06.01 Incident Handling – Assessment Procedure
------+03.06.02 Incident Monitoring, Reporting, and Response Assistance – Assessment Procedure
------+03.06.03 Incident Response Testing – Assessment Procedure
------+03.06.04 Incident Response Training – Assessment Procedure
------+03.06.05 Incident Response Plan – Assessment Procedure
------+03.07.04 Maintenance Tools – Assessment Procedure
------+03.07.05 Nonlocal Maintenance – Assessment Procedure
------+03.07.06 Maintenance Personnel – Assessment Procedure
------+03.08.01 Media Storage – Assessment Procedure
------+03.08.02 Media Access – Assessment Procedure
------+03.08.03 Media Sanitization – Assessment Procedure
------+03.08.04 Media Marking – Assessment Procedure
------+03.08.05 Media Transport – Assessment Procedure
------+03.08.07 Media Use – Assessment Procedure
------+03.08.09 System Backup – Cryptographic Protection – Assessment Procedure
------+03.09.01 Personnel Screening – Assessment Procedure
------+03.09.02 Personnel Termination and Transfer – Assessment Procedure
------+03.10.01 Physical Access Authorizations – Assessment Procedure
------+03.10.02 Monitoring Physical Access – Assessment Procedure
------+03.10.06 Alternate Work Site – Assessment Procedure
------+03.10.07 Physical Access Control – Assessment Procedure
------+03.10.08 Access Control for Transmission – Assessment Procedure
------+03.11.01 Risk Assessment – Assessment Procedure
------+03.11.02 Vulnerability Monitoring and Scanning – Assessment Procedure
------+03.11.04 Risk Response – Assessment Procedure
------+03.12.01 Security Assessment – Assessment Procedure
------+03.12.02 Plan of Action and Milestones – Assessment Procedure
------+03.12.03 Continuous Monitoring – Assessment Procedure
------+03.12.05 Information Exchange – Assessment Procedure
------+03.13.01 Boundary Protection – Assessment Procedure
------+03.13.04 Information in Shared System Resources – Assessment Procedure
------+03.13.06 Network Communications – Deny by Default – Allow by Exception – Assessment Procedure
------+03.13.08 Transmission and Storage Confidentiality – Assessment Procedure
------+03.13.09 Network Disconnect – Assessment Procedure
------+03.13.10 Cryptographic Key Establishment and Management – Assessment Procedure
------+03.13.11 Cryptographic Protection – Assessment Procedure
------+03.13.12 Collaborative Computing Devices and Applications – Assessment Procedure
------+03.13.13 Mobile Code – Assessment Procedure
------+03.13.15 Session Authenticity – Assessment Procedure
------+03.14.01 Flaw Remediation – Assessment Procedure
------+03.14.02 Malicious Code Protection – Assessment Procedure
------+03.14.03 Security Alerts, Advisories, and Directives – Assessment Procedure
------+03.14.06 System Monitoring – Assessment Procedure
------+03.14.08 Information Management and Retention – Assessment Procedure
------+03.15.01 Policy and Procedures – Assessment Procedure
------+03.15.02 System Security Plan – Assessment Procedure
------+03.15.03 Rules of Behavior – Assessment Procedure
------+03.16.01 Security Engineering Principles – Assessment Procedure
------+03.16.02 Unsupported System Components – Assessment Procedure
------+03.16.03 External System Services – Assessment Procedure
------+03.17.01 Supply Chain Risk Management Plan – Assessment Procedure
------+03.17.02 Acquisition Strategies, Tools, and Methods – Assessment Procedure
------+03.17.03 Supply Chain Requirements and Processes – Assessment Procedure

Electronic (OSCAL) Version of Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Electronic (OSCAL) Version of Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

1. Pārskats

03.01 Access Control Access Control
03.02 Awareness and Training Awareness and Training
03.03 Audit and Accountability Audit and Accountability
03.04 Configuration Management Configuration Management
03.05 Identification and Authentication Identification and Authentication
03.06 Incident Response Incident Response
03.07 Maintenance Maintenance
03.08 Media Protection Media Protection
03.09 Personnel Security Personnel Security
03.10 Physical Protection Physical Protection
03.11 Risk Assessment Risk Assessment
03.12 Security Assessment and Monitoring Security Assessment and Monitoring
03.13 System and Communications Protection System and Communications Protection
03.14 System and Information Integrity System and Information Integrity
03.15 Planning Planning
03.16 System and Services Acquisition System and Services Acquisition
03.17 Supply Chain Risk Management Supply Chain Risk Management

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

Prasības

3. Saistītie tiesību akti

Tiesību akti

Saistītie uzdevumi

Saites
is related to English
is related to Imported: NIST SP 800-171 Rev. 3 (v1.5.0-1bc9d5ab5f)
is related to New version: NIST SP 800-171 Rev. 3 (v1.5.0-1bc9d5ab5f) – 98 new, 0 changed, 0 removed, 97 links
includes NIST SP 800-171 Rev. 3 – Assessment Procedures