+Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 MODERATE IMPACT BASELINE
---+AC [M] Access Control
------+AC-01 [M] Policy and Procedures
------+AC-02 [M] Account Management
---------+AC-02(01) [M] Automated System Account Management
---------+AC-02(02) [M] Automated Temporary and Emergency Account Management
---------+AC-02(03) [M] Disable Accounts
---------+AC-02(04) [M] Automated Audit Actions
---------+AC-02(05) [M] Inactivity Logout
---------+AC-02(13) [M] Disable Accounts for High-risk Individuals
------+AC-03 [M] Access Enforcement
------+AC-04 [M] Information Flow Enforcement
------+AC-05 [M] Separation of Duties
------+AC-06 [M] Least Privilege
---------+AC-06(01) [M] Authorize Access to Security Functions
---------+AC-06(02) [M] Non-privileged Access for Nonsecurity Functions
---------+AC-06(05) [M] Privileged Accounts
---------+AC-06(07) [M] Review of User Privileges
---------+AC-06(09) [M] Log Use of Privileged Functions
---------+AC-06(10) [M] Prohibit Non-privileged Users from Executing Privileged Functions
------+AC-07 [M] Unsuccessful Logon Attempts
------+AC-08 [M] System Use Notification
------+AC-11 [M] Device Lock
---------+AC-11(01) [M] Pattern-hiding Displays
------+AC-12 [M] Session Termination
------+AC-14 [M] Permitted Actions Without Identification or Authentication
------+AC-17 [M] Remote Access
---------+AC-17(01) [M] Monitoring and Control
---------+AC-17(02) [M] Protection of Confidentiality and Integrity Using Encryption
---------+AC-17(03) [M] Managed Access Control Points
---------+AC-17(04) [M] Privileged Commands and Access
------+AC-18 [M] Wireless Access
---------+AC-18(01) [M] Authentication and Encryption
---------+AC-18(03) [M] Disable Wireless Networking
------+AC-19 [M] Access Control for Mobile Devices
---------+AC-19(05) [M] Full Device or Container-based Encryption
------+AC-20 [M] Use of External Systems
---------+AC-20(01) [M] Limits on Authorized Use
---------+AC-20(02) [M] Portable Storage Devices — Restricted Use
------+AC-21 [M] Information Sharing
------+AC-22 [M] Publicly Accessible Content
---+AT [M] Awareness and Training
------+AT-01 [M] Policy and Procedures
------+AT-02 [M] Literacy Training and Awareness
---------+AT-02(02) [M] Insider Threat
---------+AT-02(03) [M] Social Engineering and Mining
------+AT-03 [M] Role-based Training
------+AT-04 [M] Training Records
---+AU [M] Audit and Accountability
------+AU-01 [M] Policy and Procedures
------+AU-02 [M] Event Logging
------+AU-03 [M] Content of Audit Records
---------+AU-03(01) [M] Additional Audit Information
------+AU-04 [M] Audit Log Storage Capacity
------+AU-05 [M] Response to Audit Logging Process Failures
------+AU-06 [M] Audit Record Review, Analysis, and Reporting
---------+AU-06(01) [M] Automated Process Integration
---------+AU-06(03) [M] Correlate Audit Record Repositories
------+AU-07 [M] Audit Record Reduction and Report Generation
---------+AU-07(01) [M] Automatic Processing
------+AU-08 [M] Time Stamps
------+AU-09 [M] Protection of Audit Information
---------+AU-09(04) [M] Access by Subset of Privileged Users
------+AU-11 [M] Audit Record Retention
------+AU-12 [M] Audit Record Generation
---+CA [M] Assessment, Authorization, and Monitoring
------+CA-01 [M] Policy and Procedures
------+CA-02 [M] Control Assessments
---------+CA-02(01) [M] Independent Assessors
------+CA-03 [M] Information Exchange
------+CA-05 [M] Plan of Action and Milestones
------+CA-06 [M] Authorization
------+CA-07 [M] Continuous Monitoring
---------+CA-07(01) [M] Independent Assessment
---------+CA-07(04) [M] Risk Monitoring
------+CA-09 [M] Internal System Connections
---+CM [M] Configuration Management
------+CM-01 [M] Policy and Procedures
------+CM-02 [M] Baseline Configuration
---------+CM-02(02) [M] Automation Support for Accuracy and Currency
---------+CM-02(03) [M] Retention of Previous Configurations
---------+CM-02(07) [M] Configure Systems and Components for High-risk Areas
------+CM-03 [M] Configuration Change Control
---------+CM-03(02) [M] Testing, Validation, and Documentation of Changes
---------+CM-03(04) [M] Security and Privacy Representatives
------+CM-04 [M] Impact Analyses
---------+CM-04(02) [M] Verification of Controls
------+CM-05 [M] Access Restrictions for Change
------+CM-06 [M] Configuration Settings
------+CM-07 [M] Least Functionality
---------+CM-07(01) [M] Periodic Review
---------+CM-07(02) [M] Prevent Program Execution
---------+CM-07(05) [M] Authorized Software — Allow-by-exception
------+CM-08 [M] System Component Inventory
---------+CM-08(01) [M] Updates During Installation and Removal
---------+CM-08(03) [M] Automated Unauthorized Component Detection
------+CM-09 [M] Configuration Management Plan
------+CM-10 [M] Software Usage Restrictions
------+CM-11 [M] User-installed Software
------+CM-12 [M] Information Location
---------+CM-12(01) [M] Automated Tools to Support Information Location
---+CP [M] Contingency Planning
------+CP-01 [M] Policy and Procedures
------+CP-02 [M] Contingency Plan
---------+CP-02(01) [M] Coordinate with Related Plans
---------+CP-02(03) [M] Resume Mission and Business Functions
---------+CP-02(08) [M] Identify Critical Assets
------+CP-03 [M] Contingency Training
------+CP-04 [M] Contingency Plan Testing
---------+CP-04(01) [M] Coordinate with Related Plans
------+CP-06 [M] Alternate Storage Site
---------+CP-06(01) [M] Separation from Primary Site
---------+CP-06(03) [M] Accessibility
------+CP-07 [M] Alternate Processing Site
---------+CP-07(01) [M] Separation from Primary Site
---------+CP-07(02) [M] Accessibility
---------+CP-07(03) [M] Priority of Service
------+CP-08 [M] Telecommunications Services
---------+CP-08(01) [M] Priority of Service Provisions
---------+CP-08(02) [M] Single Points of Failure
------+CP-09 [M] System Backup
---------+CP-09(01) [M] Testing for Reliability and Integrity
---------+CP-09(08) [M] Cryptographic Protection
------+CP-10 [M] System Recovery and Reconstitution
---------+CP-10(02) [M] Transaction Recovery
---+IA [M] Identification and Authentication
------+IA-01 [M] Policy and Procedures
------+IA-02 [M] Identification and Authentication (Organizational Users)
---------+IA-02(01) [M] Multi-factor Authentication to Privileged Accounts
---------+IA-02(02) [M] Multi-factor Authentication to Non-privileged Accounts
---------+IA-02(08) [M] Access to Accounts — Replay Resistant
---------+IA-02(12) [M] Acceptance of PIV Credentials
------+IA-03 [M] Device Identification and Authentication
------+IA-04 [M] Identifier Management
---------+IA-04(04) [M] Identify User Status
------+IA-05 [M] Authenticator Management
---------+IA-05(01) [M] Password-based Authentication
---------+IA-05(02) [M] Public Key-based Authentication
---------+IA-05(06) [M] Protection of Authenticators
------+IA-06 [M] Authentication Feedback
------+IA-07 [M] Cryptographic Module Authentication
------+IA-08 [M] Identification and Authentication (Non-organizational Users)
---------+IA-08(01) [M] Acceptance of PIV Credentials from Other Agencies
---------+IA-08(02) [M] Acceptance of External Authenticators
---------+IA-08(04) [M] Use of Defined Profiles
------+IA-11 [M] Re-authentication
------+IA-12 [M] Identity Proofing
---------+IA-12(02) [M] Identity Evidence
---------+IA-12(03) [M] Identity Evidence Validation and Verification
---------+IA-12(05) [M] Address Confirmation
---+IR [M] Incident Response
------+IR-01 [M] Policy and Procedures
------+IR-02 [M] Incident Response Training
------+IR-03 [M] Incident Response Testing
---------+IR-03(02) [M] Coordination with Related Plans
------+IR-04 [M] Incident Handling
---------+IR-04(01) [M] Automated Incident Handling Processes
------+IR-05 [M] Incident Monitoring
------+IR-06 [M] Incident Reporting
---------+IR-06(01) [M] Automated Reporting
---------+IR-06(03) [M] Supply Chain Coordination
------+IR-07 [M] Incident Response Assistance
---------+IR-07(01) [M] Automation Support for Availability of Information and Support
------+IR-08 [M] Incident Response Plan
---+MA [M] Maintenance
------+MA-01 [M] Policy and Procedures
------+MA-02 [M] Controlled Maintenance
------+MA-03 [M] Maintenance Tools
---------+MA-03(01) [M] Inspect Tools
---------+MA-03(02) [M] Inspect Media
---------+MA-03(03) [M] Prevent Unauthorized Removal
------+MA-04 [M] Nonlocal Maintenance
------+MA-05 [M] Maintenance Personnel
------+MA-06 [M] Timely Maintenance
---+MP [M] Media Protection
------+MP-01 [M] Policy and Procedures
------+MP-02 [M] Media Access
------+MP-03 [M] Media Marking
------+MP-04 [M] Media Storage
------+MP-05 [M] Media Transport
------+MP-06 [M] Media Sanitization
------+MP-07 [M] Media Use
---+PE [M] Physical and Environmental Protection
------+PE-01 [M] Policy and Procedures
------+PE-02 [M] Physical Access Authorizations
------+PE-03 [M] Physical Access Control
------+PE-04 [M] Access Control for Transmission
------+PE-05 [M] Access Control for Output Devices
------+PE-06 [M] Monitoring Physical Access
---------+PE-06(01) [M] Intrusion Alarms and Surveillance Equipment
------+PE-08 [M] Visitor Access Records
------+PE-09 [M] Power Equipment and Cabling
------+PE-10 [M] Emergency Shutoff
------+PE-11 [M] Emergency Power
------+PE-12 [M] Emergency Lighting
------+PE-13 [M] Fire Protection
---------+PE-13(01) [M] Detection Systems — Automatic Activation and Notification
------+PE-14 [M] Environmental Controls
------+PE-15 [M] Water Damage Protection
------+PE-16 [M] Delivery and Removal
------+PE-17 [M] Alternate Work Site
---+PL [M] Planning
------+PL-01 [M] Policy and Procedures
------+PL-02 [M] System Security and Privacy Plans
------+PL-04 [M] Rules of Behavior
---------+PL-04(01) [M] Social Media and External Site/Application Usage Restrictions
------+PL-08 [M] Security and Privacy Architectures
------+PL-10 [M] Baseline Selection
------+PL-11 [M] Baseline Tailoring
---+PS [M] Personnel Security
------+PS-01 [M] Policy and Procedures
------+PS-02 [M] Position Risk Designation
------+PS-03 [M] Personnel Screening
------+PS-04 [M] Personnel Termination
------+PS-05 [M] Personnel Transfer
------+PS-06 [M] Access Agreements
------+PS-07 [M] External Personnel Security
------+PS-08 [M] Personnel Sanctions
------+PS-09 [M] Position Descriptions
---+RA [M] Risk Assessment
------+RA-01 [M] Policy and Procedures
------+RA-02 [M] Security Categorization
------+RA-03 [M] Risk Assessment
---------+RA-03(01) [M] Supply Chain Risk Assessment
------+RA-05 [M] Vulnerability Monitoring and Scanning
---------+RA-05(02) [M] Update Vulnerabilities to Be Scanned
---------+RA-05(05) [M] Privileged Access
---------+RA-05(11) [M] Public Disclosure Program
------+RA-07 [M] Risk Response
------+RA-09 [M] Criticality Analysis
---+SA [M] System and Services Acquisition
------+SA-01 [M] Policy and Procedures
------+SA-02 [M] Allocation of Resources
------+SA-03 [M] System Development Life Cycle
------+SA-04 [M] Acquisition Process
---------+SA-04(01) [M] Functional Properties of Controls
---------+SA-04(02) [M] Design and Implementation Information for Controls
---------+SA-04(09) [M] Functions, Ports, Protocols, and Services in Use
---------+SA-04(10) [M] Use of Approved PIV Products
------+SA-05 [M] System Documentation
------+SA-08 [M] Security and Privacy Engineering Principles
------+SA-09 [M] External System Services
---------+SA-09(02) [M] Identification of Functions, Ports, Protocols, and Services
------+SA-10 [M] Developer Configuration Management
------+SA-11 [M] Developer Testing and Evaluation
------+SA-15 [M] Development Process, Standards, and Tools
---------+SA-15(03) [M] Criticality Analysis
------+SA-22 [M] Unsupported System Components
---+SC [M] System and Communications Protection
------+SC-01 [M] Policy and Procedures
------+SC-02 [M] Separation of System and User Functionality
------+SC-04 [M] Information in Shared System Resources
------+SC-05 [M] Denial-of-service Protection
------+SC-07 [M] Boundary Protection
---------+SC-07(03) [M] Access Points
---------+SC-07(04) [M] External Telecommunications Services
---------+SC-07(05) [M] Deny by Default — Allow by Exception
---------+SC-07(07) [M] Split Tunneling for Remote Devices
---------+SC-07(08) [M] Route Traffic to Authenticated Proxy Servers
------+SC-08 [M] Transmission Confidentiality and Integrity
---------+SC-08(01) [M] Cryptographic Protection
------+SC-10 [M] Network Disconnect
------+SC-12 [M] Cryptographic Key Establishment and Management
------+SC-13 [M] Cryptographic Protection
------+SC-15 [M] Collaborative Computing Devices and Applications
------+SC-17 [M] Public Key Infrastructure Certificates
------+SC-18 [M] Mobile Code
------+SC-20 [M] Secure Name/Address Resolution Service (Authoritative Source)
------+SC-21 [M] Secure Name/Address Resolution Service (Recursive or Caching Resolver)
------+SC-22 [M] Architecture and Provisioning for Name/Address Resolution Service
------+SC-23 [M] Session Authenticity
------+SC-28 [M] Protection of Information at Rest
---------+SC-28(01) [M] Cryptographic Protection
------+SC-39 [M] Process Isolation
---+SI [M] System and Information Integrity
------+SI-01 [M] Policy and Procedures
------+SI-02 [M] Flaw Remediation
---------+SI-02(02) [M] Automated Flaw Remediation Status
------+SI-03 [M] Malicious Code Protection
------+SI-04 [M] System Monitoring
---------+SI-04(02) [M] Automated Tools and Mechanisms for Real-time Analysis
---------+SI-04(04) [M] Inbound and Outbound Communications Traffic
---------+SI-04(05) [M] System-generated Alerts
------+SI-05 [M] Security Alerts, Advisories, and Directives
------+SI-07 [M] Software, Firmware, and Information Integrity
---------+SI-07(01) [M] Integrity Checks
---------+SI-07(07) [M] Integration of Detection and Response
------+SI-08 [M] Spam Protection
---------+SI-08(02) [M] Automatic Updates
------+SI-10 [M] Information Input Validation
------+SI-11 [M] Error Handling
------+SI-12 [M] Information Management and Retention
------+SI-16 [M] Memory Protection
---+SR [M] Supply Chain Risk Management
------+SR-01 [M] Policy and Procedures
------+SR-02 [M] Supply Chain Risk Management Plan
---------+SR-02(01) [M] Establish SCRM Team
------+SR-03 [M] Supply Chain Controls and Processes
------+SR-05 [M] Acquisition Strategies, Tools, and Methods
------+SR-06 [M] Supplier Assessments and Reviews
------+SR-08 [M] Notification Agreements
------+SR-10 [M] Inspection of Systems or Components
------+SR-11 [M] Component Authenticity
---------+SR-11(01) [M] Anti-counterfeit Training
---------+SR-11(02) [M] Configuration Control for Component Service and Repair
------+SR-12 [M] Component Disposal
---+NIST SP 800-53 Rev. 5 MODERATE Baseline – Assessment Procedures
------+AC-01 [M] Policy and Procedures – Assessment Procedure
------+AC-02 [M] Account Management – Assessment Procedure
------+AC-02(01) [M] Automated System Account Management – Assessment Procedure
------+AC-02(02) [M] Automated Temporary and Emergency Account Management – Assessment Procedure
------+AC-02(03) [M] Disable Accounts – Assessment Procedure
------+AC-02(04) [M] Automated Audit Actions – Assessment Procedure
------+AC-02(05) [M] Inactivity Logout – Assessment Procedure
------+AC-02(13) [M] Disable Accounts for High-risk Individuals – Assessment Procedure
------+AC-03 [M] Access Enforcement – Assessment Procedure
------+AC-04 [M] Information Flow Enforcement – Assessment Procedure
------+AC-05 [M] Separation of Duties – Assessment Procedure
------+AC-06 [M] Least Privilege – Assessment Procedure
------+AC-06(01) [M] Authorize Access to Security Functions – Assessment Procedure
------+AC-06(02) [M] Non-privileged Access for Nonsecurity Functions – Assessment Procedure
------+AC-06(05) [M] Privileged Accounts – Assessment Procedure
------+AC-06(07) [M] Review of User Privileges – Assessment Procedure
------+AC-06(09) [M] Log Use of Privileged Functions – Assessment Procedure
------+AC-06(10) [M] Prohibit Non-privileged Users from Executing Privileged Functions – Assessment Procedure
------+AC-07 [M] Unsuccessful Logon Attempts – Assessment Procedure
------+AC-08 [M] System Use Notification – Assessment Procedure
------+AC-11 [M] Device Lock – Assessment Procedure
------+AC-11(01) [M] Pattern-hiding Displays – Assessment Procedure
------+AC-12 [M] Session Termination – Assessment Procedure
------+AC-14 [M] Permitted Actions Without Identification or Authentication – Assessment Procedure
------+AC-17 [M] Remote Access – Assessment Procedure
------+AC-17(01) [M] Monitoring and Control – Assessment Procedure
------+AC-17(02) [M] Protection of Confidentiality and Integrity Using Encryption – Assessment Procedure
------+AC-17(03) [M] Managed Access Control Points – Assessment Procedure
------+AC-17(04) [M] Privileged Commands and Access – Assessment Procedure
------+AC-18 [M] Wireless Access – Assessment Procedure
------+AC-18(01) [M] Authentication and Encryption – Assessment Procedure
------+AC-18(03) [M] Disable Wireless Networking – Assessment Procedure
------+AC-19 [M] Access Control for Mobile Devices – Assessment Procedure
------+AC-19(05) [M] Full Device or Container-based Encryption – Assessment Procedure
------+AC-20 [M] Use of External Systems – Assessment Procedure
------+AC-20(01) [M] Limits on Authorized Use – Assessment Procedure
------+AC-20(02) [M] Portable Storage Devices — Restricted Use – Assessment Procedure
------+AC-21 [M] Information Sharing – Assessment Procedure
------+AC-22 [M] Publicly Accessible Content – Assessment Procedure
------+AT-01 [M] Policy and Procedures – Assessment Procedure
------+AT-02 [M] Literacy Training and Awareness – Assessment Procedure
------+AT-02(02) [M] Insider Threat – Assessment Procedure
------+AT-02(03) [M] Social Engineering and Mining – Assessment Procedure
------+AT-03 [M] Role-based Training – Assessment Procedure
------+AT-04 [M] Training Records – Assessment Procedure
------+AU-01 [M] Policy and Procedures – Assessment Procedure
------+AU-02 [M] Event Logging – Assessment Procedure
------+AU-03 [M] Content of Audit Records – Assessment Procedure
------+AU-03(01) [M] Additional Audit Information – Assessment Procedure
------+AU-04 [M] Audit Log Storage Capacity – Assessment Procedure
------+AU-05 [M] Response to Audit Logging Process Failures – Assessment Procedure
------+AU-06 [M] Audit Record Review, Analysis, and Reporting – Assessment Procedure
------+AU-06(01) [M] Automated Process Integration – Assessment Procedure
------+AU-06(03) [M] Correlate Audit Record Repositories – Assessment Procedure
------+AU-07 [M] Audit Record Reduction and Report Generation – Assessment Procedure
------+AU-07(01) [M] Automatic Processing – Assessment Procedure
------+AU-08 [M] Time Stamps – Assessment Procedure
------+AU-09 [M] Protection of Audit Information – Assessment Procedure
------+AU-09(04) [M] Access by Subset of Privileged Users – Assessment Procedure
------+AU-11 [M] Audit Record Retention – Assessment Procedure
------+AU-12 [M] Audit Record Generation – Assessment Procedure
------+CA-01 [M] Policy and Procedures – Assessment Procedure
------+CA-02 [M] Control Assessments – Assessment Procedure
------+CA-02(01) [M] Independent Assessors – Assessment Procedure
------+CA-03 [M] Information Exchange – Assessment Procedure
------+CA-05 [M] Plan of Action and Milestones – Assessment Procedure
------+CA-06 [M] Authorization – Assessment Procedure
------+CA-07 [M] Continuous Monitoring – Assessment Procedure
------+CA-07(01) [M] Independent Assessment – Assessment Procedure
------+CA-07(04) [M] Risk Monitoring – Assessment Procedure
------+CA-09 [M] Internal System Connections – Assessment Procedure
------+CM-01 [M] Policy and Procedures – Assessment Procedure
------+CM-02 [M] Baseline Configuration – Assessment Procedure
------+CM-02(02) [M] Automation Support for Accuracy and Currency – Assessment Procedure
------+CM-02(03) [M] Retention of Previous Configurations – Assessment Procedure
------+CM-02(07) [M] Configure Systems and Components for High-risk Areas – Assessment Procedure
------+CM-03 [M] Configuration Change Control – Assessment Procedure
------+CM-03(02) [M] Testing, Validation, and Documentation of Changes – Assessment Procedure
------+CM-03(04) [M] Security and Privacy Representatives – Assessment Procedure
------+CM-04 [M] Impact Analyses – Assessment Procedure
------+CM-04(02) [M] Verification of Controls – Assessment Procedure
------+CM-05 [M] Access Restrictions for Change – Assessment Procedure
------+CM-06 [M] Configuration Settings – Assessment Procedure
------+CM-07 [M] Least Functionality – Assessment Procedure
------+CM-07(01) [M] Periodic Review – Assessment Procedure
------+CM-07(02) [M] Prevent Program Execution – Assessment Procedure
------+CM-07(05) [M] Authorized Software — Allow-by-exception – Assessment Procedure
------+CM-08 [M] System Component Inventory – Assessment Procedure
------+CM-08(01) [M] Updates During Installation and Removal – Assessment Procedure
------+CM-08(03) [M] Automated Unauthorized Component Detection – Assessment Procedure
------+CM-09 [M] Configuration Management Plan – Assessment Procedure
------+CM-10 [M] Software Usage Restrictions – Assessment Procedure
------+CM-11 [M] User-installed Software – Assessment Procedure
------+CM-12 [M] Information Location – Assessment Procedure
------+CM-12(01) [M] Automated Tools to Support Information Location – Assessment Procedure
------+CP-01 [M] Policy and Procedures – Assessment Procedure
------+CP-02 [M] Contingency Plan – Assessment Procedure
------+CP-02(01) [M] Coordinate with Related Plans – Assessment Procedure
------+CP-02(03) [M] Resume Mission and Business Functions – Assessment Procedure
------+CP-02(08) [M] Identify Critical Assets – Assessment Procedure
------+CP-03 [M] Contingency Training – Assessment Procedure
------+CP-04 [M] Contingency Plan Testing – Assessment Procedure
------+CP-04(01) [M] Coordinate with Related Plans – Assessment Procedure
------+CP-06 [M] Alternate Storage Site – Assessment Procedure
------+CP-06(01) [M] Separation from Primary Site – Assessment Procedure
------+CP-06(03) [M] Accessibility – Assessment Procedure
------+CP-07 [M] Alternate Processing Site – Assessment Procedure
------+CP-07(01) [M] Separation from Primary Site – Assessment Procedure
------+CP-07(02) [M] Accessibility – Assessment Procedure
------+CP-07(03) [M] Priority of Service – Assessment Procedure
------+CP-08 [M] Telecommunications Services – Assessment Procedure
------+CP-08(01) [M] Priority of Service Provisions – Assessment Procedure
------+CP-08(02) [M] Single Points of Failure – Assessment Procedure
------+CP-09 [M] System Backup – Assessment Procedure
------+CP-09(01) [M] Testing for Reliability and Integrity – Assessment Procedure
------+CP-09(08) [M] Cryptographic Protection – Assessment Procedure
------+CP-10 [M] System Recovery and Reconstitution – Assessment Procedure
------+CP-10(02) [M] Transaction Recovery – Assessment Procedure
------+IA-01 [M] Policy and Procedures – Assessment Procedure
------+IA-02 [M] Identification and Authentication (Organizational Users) – Assessment Procedure
------+IA-02(01) [M] Multi-factor Authentication to Privileged Accounts – Assessment Procedure
------+IA-02(02) [M] Multi-factor Authentication to Non-privileged Accounts – Assessment Procedure
------+IA-02(08) [M] Access to Accounts — Replay Resistant – Assessment Procedure
------+IA-02(12) [M] Acceptance of PIV Credentials – Assessment Procedure
------+IA-03 [M] Device Identification and Authentication – Assessment Procedure
------+IA-04 [M] Identifier Management – Assessment Procedure
------+IA-04(04) [M] Identify User Status – Assessment Procedure
------+IA-05 [M] Authenticator Management – Assessment Procedure
------+IA-05(01) [M] Password-based Authentication – Assessment Procedure
------+IA-05(02) [M] Public Key-based Authentication – Assessment Procedure
------+IA-05(06) [M] Protection of Authenticators – Assessment Procedure
------+IA-06 [M] Authentication Feedback – Assessment Procedure
------+IA-07 [M] Cryptographic Module Authentication – Assessment Procedure
------+IA-08 [M] Identification and Authentication (Non-organizational Users) – Assessment Procedure
------+IA-08(01) [M] Acceptance of PIV Credentials from Other Agencies – Assessment Procedure
------+IA-08(02) [M] Acceptance of External Authenticators – Assessment Procedure
------+IA-08(04) [M] Use of Defined Profiles – Assessment Procedure
------+IA-11 [M] Re-authentication – Assessment Procedure
------+IA-12 [M] Identity Proofing – Assessment Procedure
------+IA-12(02) [M] Identity Evidence – Assessment Procedure
------+IA-12(03) [M] Identity Evidence Validation and Verification – Assessment Procedure
------+IA-12(05) [M] Address Confirmation – Assessment Procedure
------+IR-01 [M] Policy and Procedures – Assessment Procedure
------+IR-02 [M] Incident Response Training – Assessment Procedure
------+IR-03 [M] Incident Response Testing – Assessment Procedure
------+IR-03(02) [M] Coordination with Related Plans – Assessment Procedure
------+IR-04 [M] Incident Handling – Assessment Procedure
------+IR-04(01) [M] Automated Incident Handling Processes – Assessment Procedure
------+IR-05 [M] Incident Monitoring – Assessment Procedure
------+IR-06 [M] Incident Reporting – Assessment Procedure
------+IR-06(01) [M] Automated Reporting – Assessment Procedure
------+IR-06(03) [M] Supply Chain Coordination – Assessment Procedure
------+IR-07 [M] Incident Response Assistance – Assessment Procedure
------+IR-07(01) [M] Automation Support for Availability of Information and Support – Assessment Procedure
------+IR-08 [M] Incident Response Plan – Assessment Procedure
------+MA-01 [M] Policy and Procedures – Assessment Procedure
------+MA-02 [M] Controlled Maintenance – Assessment Procedure
------+MA-03 [M] Maintenance Tools – Assessment Procedure
------+MA-03(01) [M] Inspect Tools – Assessment Procedure
------+MA-03(02) [M] Inspect Media – Assessment Procedure
------+MA-03(03) [M] Prevent Unauthorized Removal – Assessment Procedure
------+MA-04 [M] Nonlocal Maintenance – Assessment Procedure
------+MA-05 [M] Maintenance Personnel – Assessment Procedure
------+MA-06 [M] Timely Maintenance – Assessment Procedure
------+MP-01 [M] Policy and Procedures – Assessment Procedure
------+MP-02 [M] Media Access – Assessment Procedure
------+MP-03 [M] Media Marking – Assessment Procedure
------+MP-04 [M] Media Storage – Assessment Procedure
------+MP-05 [M] Media Transport – Assessment Procedure
------+MP-06 [M] Media Sanitization – Assessment Procedure
------+MP-07 [M] Media Use – Assessment Procedure
------+PE-01 [M] Policy and Procedures – Assessment Procedure
------+PE-02 [M] Physical Access Authorizations – Assessment Procedure
------+PE-03 [M] Physical Access Control – Assessment Procedure
------+PE-04 [M] Access Control for Transmission – Assessment Procedure
------+PE-05 [M] Access Control for Output Devices – Assessment Procedure
------+PE-06 [M] Monitoring Physical Access – Assessment Procedure
------+PE-06(01) [M] Intrusion Alarms and Surveillance Equipment – Assessment Procedure
------+PE-08 [M] Visitor Access Records – Assessment Procedure
------+PE-09 [M] Power Equipment and Cabling – Assessment Procedure
------+PE-10 [M] Emergency Shutoff – Assessment Procedure
------+PE-11 [M] Emergency Power – Assessment Procedure
------+PE-12 [M] Emergency Lighting – Assessment Procedure
------+PE-13 [M] Fire Protection – Assessment Procedure
------+PE-13(01) [M] Detection Systems — Automatic Activation and Notification – Assessment Procedure
------+PE-14 [M] Environmental Controls – Assessment Procedure
------+PE-15 [M] Water Damage Protection – Assessment Procedure
------+PE-16 [M] Delivery and Removal – Assessment Procedure
------+PE-17 [M] Alternate Work Site – Assessment Procedure
------+PL-01 [M] Policy and Procedures – Assessment Procedure
------+PL-02 [M] System Security and Privacy Plans – Assessment Procedure
------+PL-04 [M] Rules of Behavior – Assessment Procedure
------+PL-04(01) [M] Social Media and External Site/Application Usage Restrictions – Assessment Procedure
------+PL-08 [M] Security and Privacy Architectures – Assessment Procedure
------+PL-10 [M] Baseline Selection – Assessment Procedure
------+PL-11 [M] Baseline Tailoring – Assessment Procedure
------+PS-01 [M] Policy and Procedures – Assessment Procedure
------+PS-02 [M] Position Risk Designation – Assessment Procedure
------+PS-03 [M] Personnel Screening – Assessment Procedure
------+PS-04 [M] Personnel Termination – Assessment Procedure
------+PS-05 [M] Personnel Transfer – Assessment Procedure
------+PS-06 [M] Access Agreements – Assessment Procedure
------+PS-07 [M] External Personnel Security – Assessment Procedure
------+PS-08 [M] Personnel Sanctions – Assessment Procedure
------+PS-09 [M] Position Descriptions – Assessment Procedure
------+RA-01 [M] Policy and Procedures – Assessment Procedure
------+RA-02 [M] Security Categorization – Assessment Procedure
------+RA-03 [M] Risk Assessment – Assessment Procedure
------+RA-03(01) [M] Supply Chain Risk Assessment – Assessment Procedure
------+RA-05 [M] Vulnerability Monitoring and Scanning – Assessment Procedure
------+RA-05(02) [M] Update Vulnerabilities to Be Scanned – Assessment Procedure
------+RA-05(05) [M] Privileged Access – Assessment Procedure
------+RA-05(11) [M] Public Disclosure Program – Assessment Procedure
------+RA-07 [M] Risk Response – Assessment Procedure
------+RA-09 [M] Criticality Analysis – Assessment Procedure
------+SA-01 [M] Policy and Procedures – Assessment Procedure
------+SA-02 [M] Allocation of Resources – Assessment Procedure
------+SA-03 [M] System Development Life Cycle – Assessment Procedure
------+SA-04 [M] Acquisition Process – Assessment Procedure
------+SA-04(01) [M] Functional Properties of Controls – Assessment Procedure
------+SA-04(02) [M] Design and Implementation Information for Controls – Assessment Procedure
------+SA-04(09) [M] Functions, Ports, Protocols, and Services in Use – Assessment Procedure
------+SA-04(10) [M] Use of Approved PIV Products – Assessment Procedure
------+SA-05 [M] System Documentation – Assessment Procedure
------+SA-08 [M] Security and Privacy Engineering Principles – Assessment Procedure
------+SA-09 [M] External System Services – Assessment Procedure
------+SA-09(02) [M] Identification of Functions, Ports, Protocols, and Services – Assessment Procedure
------+SA-10 [M] Developer Configuration Management – Assessment Procedure
------+SA-11 [M] Developer Testing and Evaluation – Assessment Procedure
------+SA-15 [M] Development Process, Standards, and Tools – Assessment Procedure
------+SA-15(03) [M] Criticality Analysis – Assessment Procedure
------+SA-22 [M] Unsupported System Components – Assessment Procedure
------+SC-01 [M] Policy and Procedures – Assessment Procedure
------+SC-02 [M] Separation of System and User Functionality – Assessment Procedure
------+SC-04 [M] Information in Shared System Resources – Assessment Procedure
------+SC-05 [M] Denial-of-service Protection – Assessment Procedure
------+SC-07 [M] Boundary Protection – Assessment Procedure
------+SC-07(03) [M] Access Points – Assessment Procedure
------+SC-07(04) [M] External Telecommunications Services – Assessment Procedure
------+SC-07(05) [M] Deny by Default — Allow by Exception – Assessment Procedure
------+SC-07(07) [M] Split Tunneling for Remote Devices – Assessment Procedure
------+SC-07(08) [M] Route Traffic to Authenticated Proxy Servers – Assessment Procedure
------+SC-08 [M] Transmission Confidentiality and Integrity – Assessment Procedure
------+SC-08(01) [M] Cryptographic Protection – Assessment Procedure
------+SC-10 [M] Network Disconnect – Assessment Procedure
------+SC-12 [M] Cryptographic Key Establishment and Management – Assessment Procedure
------+SC-13 [M] Cryptographic Protection – Assessment Procedure
------+SC-15 [M] Collaborative Computing Devices and Applications – Assessment Procedure
------+SC-17 [M] Public Key Infrastructure Certificates – Assessment Procedure
------+SC-18 [M] Mobile Code – Assessment Procedure
------+SC-20 [M] Secure Name/Address Resolution Service (Authoritative Source) – Assessment Procedure
------+SC-21 [M] Secure Name/Address Resolution Service (Recursive or Caching Resolver) – Assessment Procedure
------+SC-22 [M] Architecture and Provisioning for Name/Address Resolution Service – Assessment Procedure
------+SC-23 [M] Session Authenticity – Assessment Procedure
------+SC-28 [M] Protection of Information at Rest – Assessment Procedure
------+SC-28(01) [M] Cryptographic Protection – Assessment Procedure
------+SC-39 [M] Process Isolation – Assessment Procedure
------+SI-01 [M] Policy and Procedures – Assessment Procedure
------+SI-02 [M] Flaw Remediation – Assessment Procedure
------+SI-02(02) [M] Automated Flaw Remediation Status – Assessment Procedure
------+SI-03 [M] Malicious Code Protection – Assessment Procedure
------+SI-04 [M] System Monitoring – Assessment Procedure
------+SI-04(02) [M] Automated Tools and Mechanisms for Real-time Analysis – Assessment Procedure
------+SI-04(04) [M] Inbound and Outbound Communications Traffic – Assessment Procedure
------+SI-04(05) [M] System-generated Alerts – Assessment Procedure
------+SI-05 [M] Security Alerts, Advisories, and Directives – Assessment Procedure
------+SI-07 [M] Software, Firmware, and Information Integrity – Assessment Procedure
------+SI-07(01) [M] Integrity Checks – Assessment Procedure
------+SI-07(07) [M] Integration of Detection and Response – Assessment Procedure
------+SI-08 [M] Spam Protection – Assessment Procedure
------+SI-08(02) [M] Automatic Updates – Assessment Procedure
------+SI-10 [M] Information Input Validation – Assessment Procedure
------+SI-11 [M] Error Handling – Assessment Procedure
------+SI-12 [M] Information Management and Retention – Assessment Procedure
------+SI-16 [M] Memory Protection – Assessment Procedure
------+SR-01 [M] Policy and Procedures – Assessment Procedure
------+SR-02 [M] Supply Chain Risk Management Plan – Assessment Procedure
------+SR-02(01) [M] Establish SCRM Team – Assessment Procedure
------+SR-03 [M] Supply Chain Controls and Processes – Assessment Procedure
------+SR-05 [M] Acquisition Strategies, Tools, and Methods – Assessment Procedure
------+SR-06 [M] Supplier Assessments and Reviews – Assessment Procedure
------+SR-08 [M] Notification Agreements – Assessment Procedure
------+SR-10 [M] Inspection of Systems or Components – Assessment Procedure
------+SR-11 [M] Component Authenticity – Assessment Procedure
------+SR-11(01) [M] Anti-counterfeit Training – Assessment Procedure
------+SR-11(02) [M] Configuration Control for Component Service and Repair – Assessment Procedure
------+SR-12 [M] Component Disposal – Assessment Procedure

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 MODERATE IMPACT BASELINE

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 MODERATE IMPACT BASELINE

1. Ħarsa ġenerali

AC [M] Access Control Access Control
AT [M] Awareness and Training Awareness and Training
AU [M] Audit and Accountability Audit and Accountability
CA [M] Assessment, Authorization, and Monitoring Assessment, Authorization, and Monitoring
CM [M] Configuration Management Configuration Management
CP [M] Contingency Planning Contingency Planning
IA [M] Identification and Authentication Identification and Authentication
IR [M] Incident Response Incident Response
MA [M] Maintenance Maintenance
MP [M] Media Protection Media Protection
PE [M] Physical and Environmental Protection Physical and Environmental Protection
PL [M] Planning Planning
PS [M] Personnel Security Personnel Security
RA [M] Risk Assessment Risk Assessment
SA [M] System and Services Acquisition System and Services Acquisition
SC [M] System and Communications Protection System and Communications Protection
SI [M] System and Information Integrity System and Information Integrity
SR [M] Supply Chain Risk Management Supply Chain Risk Management

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is related to English
is related to New version: NIST SP 800-53 Rev. 5 MODERATE Baseline (v1.5.0-7b754e4c16) – 110 new, 0 changed, 0 removed
is related to New version: NIST SP 800-53 Rev. 5 MODERATE Baseline (v1.5.0-7b754e4c16) – 288 new, 0 changed, 0 removed, 287 links
includes NIST SP 800-53 Rev. 5 MODERATE Baseline – Assessment Procedures