+Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures
---+AC Access Control
------+AC-01 Policy and Procedures
------+AC-02 Account Management
---------+AC-02(01) Automated System Account Management
---------+AC-02(02) Automated Temporary and Emergency Account Management
---------+AC-02(03) Disable Accounts
---------+AC-02(04) Automated Audit Actions
---------+AC-02(05) Inactivity Logout
---------+AC-02(06) Dynamic Privilege Management
---------+AC-02(07) Privileged User Accounts
---------+AC-02(08) Dynamic Account Management
---------+AC-02(09) Restrictions on Use of Shared and Group Accounts
---------+AC-02(11) Usage Conditions
---------+AC-02(12) Account Monitoring for Atypical Usage
---------+AC-02(13) Disable Accounts for High-risk Individuals
------+AC-03 Access Enforcement
---------+AC-03(02) Dual Authorization
---------+AC-03(03) Mandatory Access Control
---------+AC-03(04) Discretionary Access Control
---------+AC-03(05) Security-relevant Information
---------+AC-03(07) Role-based Access Control
---------+AC-03(08) Revocation of Access Authorizations
---------+AC-03(09) Controlled Release
---------+AC-03(10) Audited Override of Access Control Mechanisms
---------+AC-03(11) Restrict Access to Specific Information Types
---------+AC-03(12) Assert and Enforce Application Access
---------+AC-03(13) Attribute-based Access Control
---------+AC-03(14) Individual Access
---------+AC-03(15) Discretionary and Mandatory Access Control
------+AC-04 Information Flow Enforcement
---------+AC-04(01) Object Security and Privacy Attributes
---------+AC-04(02) Processing Domains
---------+AC-04(03) Dynamic Information Flow Control
---------+AC-04(04) Flow Control of Encrypted Information
---------+AC-04(05) Embedded Data Types
---------+AC-04(06) Metadata
---------+AC-04(07) One-way Flow Mechanisms
---------+AC-04(08) Security and Privacy Policy Filters
---------+AC-04(09) Human Reviews
---------+AC-04(10) Enable and Disable Security or Privacy Policy Filters
---------+AC-04(11) Configuration of Security or Privacy Policy Filters
---------+AC-04(12) Data Type Identifiers
---------+AC-04(13) Decomposition into Policy-relevant Subcomponents
---------+AC-04(14) Security or Privacy Policy Filter Constraints
---------+AC-04(15) Detection of Unsanctioned Information
---------+AC-04(17) Domain Authentication
---------+AC-04(19) Validation of Metadata
---------+AC-04(20) Approved Solutions
---------+AC-04(21) Physical or Logical Separation of Information Flows
---------+AC-04(22) Access Only
---------+AC-04(23) Modify Non-releasable Information
---------+AC-04(24) Internal Normalized Format
---------+AC-04(25) Data Sanitization
---------+AC-04(26) Audit Filtering Actions
---------+AC-04(27) Redundant/Independent Filtering Mechanisms
---------+AC-04(28) Linear Filter Pipelines
---------+AC-04(29) Filter Orchestration Engines
---------+AC-04(30) Filter Mechanisms Using Multiple Processes
---------+AC-04(31) Failed Content Transfer Prevention
---------+AC-04(32) Process Requirements for Information Transfer
------+AC-05 Separation of Duties
------+AC-06 Least Privilege
---------+AC-06(01) Authorize Access to Security Functions
---------+AC-06(02) Non-privileged Access for Nonsecurity Functions
---------+AC-06(03) Network Access to Privileged Commands
---------+AC-06(04) Separate Processing Domains
---------+AC-06(05) Privileged Accounts
---------+AC-06(06) Privileged Access by Non-organizational Users
---------+AC-06(07) Review of User Privileges
---------+AC-06(08) Privilege Levels for Code Execution
---------+AC-06(09) Log Use of Privileged Functions
---------+AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions
------+AC-07 Unsuccessful Logon Attempts
---------+AC-07(02) Purge or Wipe Mobile Device
---------+AC-07(03) Biometric Attempt Limiting
---------+AC-07(04) Use of Alternate Authentication Factor
------+AC-08 System Use Notification
------+AC-09 Previous Logon Notification
---------+AC-09(01) Unsuccessful Logons
---------+AC-09(02) Successful and Unsuccessful Logons
---------+AC-09(03) Notification of Account Changes
---------+AC-09(04) Additional Logon Information
------+AC-10 Concurrent Session Control
------+AC-11 Device Lock
---------+AC-11(01) Pattern-hiding Displays
------+AC-12 Session Termination
---------+AC-12(01) User-initiated Logouts
---------+AC-12(02) Termination Message
---------+AC-12(03) Timeout Warning Message
------+AC-13 Supervision and Review — Access Control
------+AC-14 Permitted Actions Without Identification or Authentication
------+AC-15 Automated Marking
------+AC-16 Security and Privacy Attributes
---------+AC-16(01) Dynamic Attribute Association
---------+AC-16(02) Attribute Value Changes by Authorized Individuals
---------+AC-16(03) Maintenance of Attribute Associations by System
---------+AC-16(04) Association of Attributes by Authorized Individuals
---------+AC-16(05) Attribute Displays on Objects to Be Output
---------+AC-16(06) Maintenance of Attribute Association
---------+AC-16(07) Consistent Attribute Interpretation
---------+AC-16(08) Association Techniques and Technologies
---------+AC-16(09) Attribute Reassignment — Regrading Mechanisms
---------+AC-16(10) Attribute Configuration by Authorized Individuals
------+AC-17 Remote Access
---------+AC-17(01) Monitoring and Control
---------+AC-17(02) Protection of Confidentiality and Integrity Using Encryption
---------+AC-17(03) Managed Access Control Points
---------+AC-17(04) Privileged Commands and Access
---------+AC-17(06) Protection of Mechanism Information
---------+AC-17(09) Disconnect or Disable Access
---------+AC-17(10) Authenticate Remote Commands
------+AC-18 Wireless Access
---------+AC-18(01) Authentication and Encryption
---------+AC-18(03) Disable Wireless Networking
---------+AC-18(04) Restrict Configurations by Users
---------+AC-18(05) Antennas and Transmission Power Levels
------+AC-19 Access Control for Mobile Devices
---------+AC-19(04) Restrictions for Classified Information
---------+AC-19(05) Full Device or Container-based Encryption
------+AC-20 Use of External Systems
---------+AC-20(01) Limits on Authorized Use
---------+AC-20(02) Portable Storage Devices — Restricted Use
---------+AC-20(03) Non-organizationally Owned Systems — Restricted Use
---------+AC-20(04) Network Accessible Storage Devices — Prohibited Use
---------+AC-20(05) Portable Storage Devices — Prohibited Use
------+AC-21 Information Sharing
---------+AC-21(01) Automated Decision Support
---------+AC-21(02) Information Search and Retrieval
------+AC-22 Publicly Accessible Content
------+AC-23 Data Mining Protection
------+AC-24 Access Control Decisions
---------+AC-24(01) Transmit Access Authorization Information
---------+AC-24(02) No User or Process Identity
------+AC-25 Reference Monitor
---+AT Awareness and Training
------+AT-01 Policy and Procedures
------+AT-02 Literacy Training and Awareness
---------+AT-02(01) Practical Exercises
---------+AT-02(02) Insider Threat
---------+AT-02(03) Social Engineering and Mining
---------+AT-02(04) Suspicious Communications and Anomalous System Behavior
---------+AT-02(05) Advanced Persistent Threat
---------+AT-02(06) Cyber Threat Environment
------+AT-03 Role-based Training
---------+AT-03(01) Environmental Controls
---------+AT-03(02) Physical Security Controls
---------+AT-03(03) Practical Exercises
---------+AT-03(05) Processing Personally Identifiable Information
------+AT-04 Training Records
------+AT-05 Contacts with Security Groups and Associations
------+AT-06 Training Feedback
---+AU Audit and Accountability
------+AU-01 Policy and Procedures
------+AU-02 Event Logging
------+AU-03 Content of Audit Records
---------+AU-03(01) Additional Audit Information
---------+AU-03(03) Limit Personally Identifiable Information Elements
------+AU-04 Audit Log Storage Capacity
---------+AU-04(01) Transfer to Alternate Storage
------+AU-05 Response to Audit Logging Process Failures
---------+AU-05(01) Storage Capacity Warning
---------+AU-05(02) Real-time Alerts
---------+AU-05(03) Configurable Traffic Volume Thresholds
---------+AU-05(04) Shutdown on Failure
---------+AU-05(05) Alternate Audit Logging Capability
------+AU-06 Audit Record Review, Analysis, and Reporting
---------+AU-06(01) Automated Process Integration
---------+AU-06(03) Correlate Audit Record Repositories
---------+AU-06(04) Central Review and Analysis
---------+AU-06(05) Integrated Analysis of Audit Records
---------+AU-06(06) Correlation with Physical Monitoring
---------+AU-06(07) Permitted Actions
---------+AU-06(08) Full Text Analysis of Privileged Commands
---------+AU-06(09) Correlation with Information from Nontechnical Sources
------+AU-07 Audit Record Reduction and Report Generation
---------+AU-07(01) Automatic Processing
------+AU-08 Time Stamps
------+AU-09 Protection of Audit Information
---------+AU-09(01) Hardware Write-once Media
---------+AU-09(02) Store on Separate Physical Systems or Components
---------+AU-09(03) Cryptographic Protection
---------+AU-09(04) Access by Subset of Privileged Users
---------+AU-09(05) Dual Authorization
---------+AU-09(06) Read-only Access
---------+AU-09(07) Store on Component with Different Operating System
------+AU-10 Non-repudiation
---------+AU-10(01) Association of Identities
---------+AU-10(02) Validate Binding of Information Producer Identity
---------+AU-10(03) Chain of Custody
---------+AU-10(04) Validate Binding of Information Reviewer Identity
------+AU-11 Audit Record Retention
---------+AU-11(01) Long-term Retrieval Capability
------+AU-12 Audit Record Generation
---------+AU-12(01) System-wide and Time-correlated Audit Trail
---------+AU-12(02) Standardized Formats
---------+AU-12(03) Changes by Authorized Individuals
---------+AU-12(04) Query Parameter Audits of Personally Identifiable Information
------+AU-13 Monitoring for Information Disclosure
---------+AU-13(01) Use of Automated Tools
---------+AU-13(02) Review of Monitored Sites
---------+AU-13(03) Unauthorized Replication of Information
------+AU-14 Session Audit
---------+AU-14(01) System Start-up
---------+AU-14(03) Remote Viewing and Listening
------+AU-15 Alternate Audit Logging Capability
------+AU-16 Cross-organizational Audit Logging
---------+AU-16(01) Identity Preservation
---------+AU-16(02) Sharing of Audit Information
---------+AU-16(03) Disassociability
---+CA Assessment, Authorization, and Monitoring
------+CA-01 Policy and Procedures
------+CA-02 Control Assessments
---------+CA-02(01) Independent Assessors
---------+CA-02(02) Specialized Assessments
---------+CA-02(03) Leveraging Results from External Organizations
------+CA-03 Information Exchange
---------+CA-03(06) Transfer Authorizations
---------+CA-03(07) Transitive Information Exchanges
------+CA-04 Security Certification
------+CA-05 Plan of Action and Milestones
---------+CA-05(01) Automation Support for Accuracy and Currency
------+CA-06 Authorization
---------+CA-06(01) Joint Authorization — Intra-organization
---------+CA-06(02) Joint Authorization — Inter-organization
------+CA-07 Continuous Monitoring
---------+CA-07(01) Independent Assessment
---------+CA-07(03) Trend Analyses
---------+CA-07(04) Risk Monitoring
---------+CA-07(05) Consistency Analysis
---------+CA-07(06) Automation Support for Monitoring
------+CA-08 Penetration Testing
---------+CA-08(01) Independent Penetration Testing Agent or Team
---------+CA-08(02) Red Team Exercises
---------+CA-08(03) Facility Penetration Testing
------+CA-09 Internal System Connections
---------+CA-09(01) Compliance Checks
---+CM Configuration Management
------+CM-01 Policy and Procedures
------+CM-02 Baseline Configuration
---------+CM-02(02) Automation Support for Accuracy and Currency
---------+CM-02(03) Retention of Previous Configurations
---------+CM-02(06) Development and Test Environments
---------+CM-02(07) Configure Systems and Components for High-risk Areas
------+CM-03 Configuration Change Control
---------+CM-03(01) Automated Documentation, Notification, and Prohibition of Changes
---------+CM-03(02) Testing, Validation, and Documentation of Changes
---------+CM-03(03) Automated Change Implementation
---------+CM-03(04) Security and Privacy Representatives
---------+CM-03(05) Automated Security Response
---------+CM-03(06) Cryptography Management
---------+CM-03(07) Review System Changes
---------+CM-03(08) Prevent or Restrict Configuration Changes
------+CM-04 Impact Analyses
---------+CM-04(01) Separate Test Environments
---------+CM-04(02) Verification of Controls
------+CM-05 Access Restrictions for Change
---------+CM-05(01) Automated Access Enforcement and Audit Records
---------+CM-05(04) Dual Authorization
---------+CM-05(05) Privilege Limitation for Production and Operation
---------+CM-05(06) Limit Library Privileges
------+CM-06 Configuration Settings
---------+CM-06(01) Automated Management, Application, and Verification
---------+CM-06(02) Respond to Unauthorized Changes
------+CM-07 Least Functionality
---------+CM-07(01) Periodic Review
---------+CM-07(02) Prevent Program Execution
---------+CM-07(03) Registration Compliance
---------+CM-07(04) Unauthorized Software — Deny-by-exception
---------+CM-07(05) Authorized Software — Allow-by-exception
---------+CM-07(06) Confined Environments with Limited Privileges
---------+CM-07(07) Code Execution in Protected Environments
---------+CM-07(08) Binary or Machine Executable Code
---------+CM-07(09) Prohibiting The Use of Unauthorized Hardware
------+CM-08 System Component Inventory
---------+CM-08(01) Updates During Installation and Removal
---------+CM-08(02) Automated Maintenance
---------+CM-08(03) Automated Unauthorized Component Detection
---------+CM-08(04) Accountability Information
---------+CM-08(06) Assessed Configurations and Approved Deviations
---------+CM-08(07) Centralized Repository
---------+CM-08(08) Automated Location Tracking
---------+CM-08(09) Assignment of Components to Systems
------+CM-09 Configuration Management Plan
---------+CM-09(01) Assignment of Responsibility
------+CM-10 Software Usage Restrictions
---------+CM-10(01) Open-source Software
------+CM-11 User-installed Software
---------+CM-11(02) Software Installation with Privileged Status
---------+CM-11(03) Automated Enforcement and Monitoring
------+CM-12 Information Location
---------+CM-12(01) Automated Tools to Support Information Location
------+CM-13 Data Action Mapping
------+CM-14 Signed Components
---+CP Contingency Planning
------+CP-01 Policy and Procedures
------+CP-02 Contingency Plan
---------+CP-02(01) Coordinate with Related Plans
---------+CP-02(02) Capacity Planning
---------+CP-02(03) Resume Mission and Business Functions
---------+CP-02(05) Continue Mission and Business Functions
---------+CP-02(06) Alternate Processing and Storage Sites
---------+CP-02(07) Coordinate with External Service Providers
---------+CP-02(08) Identify Critical Assets
------+CP-03 Contingency Training
---------+CP-03(01) Simulated Events
---------+CP-03(02) Mechanisms Used in Training Environments
------+CP-04 Contingency Plan Testing
---------+CP-04(01) Coordinate with Related Plans
---------+CP-04(02) Alternate Processing Site
---------+CP-04(03) Automated Testing
---------+CP-04(04) Full Recovery and Reconstitution
---------+CP-04(05) Self-challenge
------+CP-05 Contingency Plan Update
------+CP-06 Alternate Storage Site
---------+CP-06(01) Separation from Primary Site
---------+CP-06(02) Recovery Time and Recovery Point Objectives
---------+CP-06(03) Accessibility
------+CP-07 Alternate Processing Site
---------+CP-07(01) Separation from Primary Site
---------+CP-07(02) Accessibility
---------+CP-07(03) Priority of Service
---------+CP-07(04) Preparation for Use
---------+CP-07(06) Inability to Return to Primary Site
------+CP-08 Telecommunications Services
---------+CP-08(01) Priority of Service Provisions
---------+CP-08(02) Single Points of Failure
---------+CP-08(03) Separation of Primary and Alternate Providers
---------+CP-08(04) Provider Contingency Plan
---------+CP-08(05) Alternate Telecommunication Service Testing
------+CP-09 System Backup
---------+CP-09(01) Testing for Reliability and Integrity
---------+CP-09(02) Test Restoration Using Sampling
---------+CP-09(03) Separate Storage for Critical Information
---------+CP-09(05) Transfer to Alternate Storage Site
---------+CP-09(06) Redundant Secondary System
---------+CP-09(07) Dual Authorization for Deletion or Destruction
---------+CP-09(08) Cryptographic Protection
------+CP-10 System Recovery and Reconstitution
---------+CP-10(02) Transaction Recovery
---------+CP-10(04) Restore Within Time Period
---------+CP-10(06) Component Protection
------+CP-11 Alternate Communications Protocols
------+CP-12 Safe Mode
------+CP-13 Alternative Security Mechanisms
---+IA Identification and Authentication
------+IA-01 Policy and Procedures
------+IA-02 Identification and Authentication (Organizational Users)
---------+IA-02(01) Multi-factor Authentication to Privileged Accounts
---------+IA-02(02) Multi-factor Authentication to Non-privileged Accounts
---------+IA-02(05) Individual Authentication with Group Authentication
---------+IA-02(06) Access to Accounts —separate Device
---------+IA-02(08) Access to Accounts — Replay Resistant
---------+IA-02(10) Single Sign-on
---------+IA-02(12) Acceptance of PIV Credentials
---------+IA-02(13) Out-of-band Authentication
------+IA-03 Device Identification and Authentication
---------+IA-03(01) Cryptographic Bidirectional Authentication
---------+IA-03(03) Dynamic Address Allocation
---------+IA-03(04) Device Attestation
------+IA-04 Identifier Management
---------+IA-04(01) Prohibit Account Identifiers as Public Identifiers
---------+IA-04(04) Identify User Status
---------+IA-04(05) Dynamic Management
---------+IA-04(06) Cross-organization Management
---------+IA-04(08) Pairwise Pseudonymous Identifiers
---------+IA-04(09) Attribute Maintenance and Protection
------+IA-05 Authenticator Management
---------+IA-05(01) Password-based Authentication
---------+IA-05(02) Public Key-based Authentication
---------+IA-05(05) Change Authenticators Prior to Delivery
---------+IA-05(06) Protection of Authenticators
---------+IA-05(07) No Embedded Unencrypted Static Authenticators
---------+IA-05(08) Multiple System Accounts
---------+IA-05(09) Federated Credential Management
---------+IA-05(10) Dynamic Credential Binding
---------+IA-05(12) Biometric Authentication Performance
---------+IA-05(13) Expiration of Cached Authenticators
---------+IA-05(14) Managing Content of PKI Trust Stores
---------+IA-05(15) GSA-approved Products and Services
---------+IA-05(16) In-person or Trusted External Party Authenticator Issuance
---------+IA-05(17) Presentation Attack Detection for Biometric Authenticators
---------+IA-05(18) Password Managers
------+IA-06 Authentication Feedback
------+IA-07 Cryptographic Module Authentication
------+IA-08 Identification and Authentication (Non-organizational Users)
---------+IA-08(01) Acceptance of PIV Credentials from Other Agencies
---------+IA-08(02) Acceptance of External Authenticators
---------+IA-08(04) Use of Defined Profiles
---------+IA-08(05) Acceptance of PIV-I Credentials
---------+IA-08(06) Disassociability
------+IA-09 Service Identification and Authentication
------+IA-10 Adaptive Authentication
------+IA-11 Re-authentication
------+IA-12 Identity Proofing
---------+IA-12(01) Supervisor Authorization
---------+IA-12(02) Identity Evidence
---------+IA-12(03) Identity Evidence Validation and Verification
---------+IA-12(04) In-person Validation and Verification
---------+IA-12(05) Address Confirmation
---------+IA-12(06) Accept Externally-proofed Identities
------+IA-13 Identity Providers and Authorization Servers
---------+IA-13(01) Protection of Cryptographic Keys
---------+IA-13(02) Verification of Identity Assertions and Access Tokens
---------+IA-13(03) Token Management
---+IR Incident Response
------+IR-01 Policy and Procedures
------+IR-02 Incident Response Training
---------+IR-02(01) Simulated Events
---------+IR-02(02) Automated Training Environments
---------+IR-02(03) Breach
------+IR-03 Incident Response Testing
---------+IR-03(01) Automated Testing
---------+IR-03(02) Coordination with Related Plans
---------+IR-03(03) Continuous Improvement
------+IR-04 Incident Handling
---------+IR-04(01) Automated Incident Handling Processes
---------+IR-04(02) Dynamic Reconfiguration
---------+IR-04(03) Continuity of Operations
---------+IR-04(04) Information Correlation
---------+IR-04(05) Automatic Disabling of System
---------+IR-04(06) Insider Threats
---------+IR-04(07) Insider Threats — Intra-organization Coordination
---------+IR-04(08) Correlation with External Organizations
---------+IR-04(09) Dynamic Response Capability
---------+IR-04(10) Supply Chain Coordination
---------+IR-04(11) Integrated Incident Response Team
---------+IR-04(12) Malicious Code and Forensic Analysis
---------+IR-04(13) Behavior Analysis
---------+IR-04(14) Security Operations Center
---------+IR-04(15) Public Relations and Reputation Repair
------+IR-05 Incident Monitoring
---------+IR-05(01) Automated Tracking, Data Collection, and Analysis
------+IR-06 Incident Reporting
---------+IR-06(01) Automated Reporting
---------+IR-06(02) Vulnerabilities Related to Incidents
---------+IR-06(03) Supply Chain Coordination
------+IR-07 Incident Response Assistance
---------+IR-07(01) Automation Support for Availability of Information and Support
---------+IR-07(02) Coordination with External Providers
------+IR-08 Incident Response Plan
---------+IR-08(01) Breaches
------+IR-09 Information Spillage Response
---------+IR-09(02) Training
---------+IR-09(03) Post-spill Operations
---------+IR-09(04) Exposure to Unauthorized Personnel
------+IR-10 Integrated Information Security Analysis Team
---+MA Maintenance
------+MA-01 Policy and Procedures
------+MA-02 Controlled Maintenance
---------+MA-02(02) Automated Maintenance Activities
------+MA-03 Maintenance Tools
---------+MA-03(01) Inspect Tools
---------+MA-03(02) Inspect Media
---------+MA-03(03) Prevent Unauthorized Removal
---------+MA-03(04) Restricted Tool Use
---------+MA-03(05) Execution with Privilege
---------+MA-03(06) Software Updates and Patches
------+MA-04 Nonlocal Maintenance
---------+MA-04(01) Logging and Review
---------+MA-04(03) Comparable Security and Sanitization
---------+MA-04(04) Authentication and Separation of Maintenance Sessions
---------+MA-04(05) Approvals and Notifications
---------+MA-04(06) Cryptographic Protection
---------+MA-04(07) Disconnect Verification
------+MA-05 Maintenance Personnel
---------+MA-05(01) Individuals Without Appropriate Access
---------+MA-05(02) Security Clearances for Classified Systems
---------+MA-05(03) Citizenship Requirements for Classified Systems
---------+MA-05(04) Foreign Nationals
---------+MA-05(05) Non-system Maintenance
------+MA-06 Timely Maintenance
---------+MA-06(01) Preventive Maintenance
---------+MA-06(02) Predictive Maintenance
---------+MA-06(03) Automated Support for Predictive Maintenance
------+MA-07 Field Maintenance
---+MP Media Protection
------+MP-01 Policy and Procedures
------+MP-02 Media Access
------+MP-03 Media Marking
------+MP-04 Media Storage
---------+MP-04(02) Automated Restricted Access
------+MP-05 Media Transport
---------+MP-05(03) Custodians
------+MP-06 Media Sanitization
---------+MP-06(01) Review, Approve, Track, Document, and Verify
---------+MP-06(02) Equipment Testing
---------+MP-06(03) Nondestructive Techniques
---------+MP-06(07) Dual Authorization
---------+MP-06(08) Remote Purging or Wiping of Information
------+MP-07 Media Use
---------+MP-07(02) Prohibit Use of Sanitization-resistant Media
------+MP-08 Media Downgrading
---------+MP-08(01) Documentation of Process
---------+MP-08(02) Equipment Testing
---------+MP-08(03) Controlled Unclassified Information
---------+MP-08(04) Classified Information
---+PE Physical and Environmental Protection
------+PE-01 Policy and Procedures
------+PE-02 Physical Access Authorizations
---------+PE-02(01) Access by Position or Role
---------+PE-02(02) Two Forms of Identification
---------+PE-02(03) Restrict Unescorted Access
------+PE-03 Physical Access Control
---------+PE-03(01) System Access
---------+PE-03(02) Facility and Systems
---------+PE-03(03) Continuous Guards
---------+PE-03(04) Lockable Casings
---------+PE-03(05) Tamper Protection
---------+PE-03(07) Physical Barriers
---------+PE-03(08) Access Control Vestibules
------+PE-04 Access Control for Transmission
------+PE-05 Access Control for Output Devices
---------+PE-05(02) Link to Individual Identity
------+PE-06 Monitoring Physical Access
---------+PE-06(01) Intrusion Alarms and Surveillance Equipment
---------+PE-06(02) Automated Intrusion Recognition and Responses
---------+PE-06(03) Video Surveillance
---------+PE-06(04) Monitoring Physical Access to Systems
------+PE-07 Visitor Control
------+PE-08 Visitor Access Records
---------+PE-08(01) Automated Records Maintenance and Review
---------+PE-08(03) Limit Personally Identifiable Information Elements
------+PE-09 Power Equipment and Cabling
---------+PE-09(01) Redundant Cabling
---------+PE-09(02) Automatic Voltage Controls
------+PE-10 Emergency Shutoff
------+PE-11 Emergency Power
---------+PE-11(01) Alternate Power Supply — Minimal Operational Capability
---------+PE-11(02) Alternate Power Supply — Self-contained
------+PE-12 Emergency Lighting
---------+PE-12(01) Essential Mission and Business Functions
------+PE-13 Fire Protection
---------+PE-13(01) Detection Systems — Automatic Activation and Notification
---------+PE-13(02) Suppression Systems — Automatic Activation and Notification
---------+PE-13(04) Inspections
------+PE-14 Environmental Controls
---------+PE-14(01) Automatic Controls
---------+PE-14(02) Monitoring with Alarms and Notifications
------+PE-15 Water Damage Protection
---------+PE-15(01) Automation Support
------+PE-16 Delivery and Removal
------+PE-17 Alternate Work Site
------+PE-18 Location of System Components
------+PE-19 Information Leakage
---------+PE-19(01) National Emissions Policies and Procedures
------+PE-20 Asset Monitoring and Tracking
------+PE-21 Electromagnetic Pulse Protection
------+PE-22 Component Marking
------+PE-23 Facility Location
---+PL Planning
------+PL-01 Policy and Procedures
------+PL-02 System Security and Privacy Plans
------+PL-03 System Security Plan Update
------+PL-04 Rules of Behavior
---------+PL-04(01) Social Media and External Site/Application Usage Restrictions
------+PL-05 Privacy Impact Assessment
------+PL-06 Security-related Activity Planning
------+PL-07 Concept of Operations
------+PL-08 Security and Privacy Architectures
---------+PL-08(01) Defense in Depth
---------+PL-08(02) Supplier Diversity
------+PL-09 Central Management
------+PL-10 Baseline Selection
------+PL-11 Baseline Tailoring
---+PM Program Management
------+PM-01 Information Security Program Plan
------+PM-02 Information Security Program Leadership Role
------+PM-03 Information Security and Privacy Resources
------+PM-04 Plan of Action and Milestones Process
------+PM-05 System Inventory
---------+PM-05(01) Inventory of Personally Identifiable Information
------+PM-06 Measures of Performance
------+PM-07 Enterprise Architecture
---------+PM-07(01) Offloading
------+PM-08 Critical Infrastructure Plan
------+PM-09 Risk Management Strategy
------+PM-10 Authorization Process
------+PM-11 Mission and Business Process Definition
------+PM-12 Insider Threat Program
------+PM-13 Security and Privacy Workforce
------+PM-14 Testing, Training, and Monitoring
------+PM-15 Security and Privacy Groups and Associations
------+PM-16 Threat Awareness Program
---------+PM-16(01) Automated Means for Sharing Threat Intelligence
------+PM-17 Protecting Controlled Unclassified Information on External Systems
------+PM-18 Privacy Program Plan
------+PM-19 Privacy Program Leadership Role
------+PM-20 Dissemination of Privacy Program Information
---------+PM-20(01) Privacy Policies on Websites, Applications, and Digital Services
------+PM-21 Accounting of Disclosures
------+PM-22 Personally Identifiable Information Quality Management
------+PM-23 Data Governance Body
------+PM-24 Data Integrity Board
------+PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
------+PM-26 Complaint Management
------+PM-27 Privacy Reporting
------+PM-28 Risk Framing
------+PM-29 Risk Management Program Leadership Roles
------+PM-30 Supply Chain Risk Management Strategy
---------+PM-30(01) Suppliers of Critical or Mission-essential Items
------+PM-31 Continuous Monitoring Strategy
------+PM-32 Purposing
---+PS Personnel Security
------+PS-01 Policy and Procedures
------+PS-02 Position Risk Designation
------+PS-03 Personnel Screening
---------+PS-03(01) Classified Information
---------+PS-03(02) Formal Indoctrination
---------+PS-03(03) Information Requiring Special Protective Measures
---------+PS-03(04) Citizenship Requirements
------+PS-04 Personnel Termination
---------+PS-04(01) Post-employment Requirements
---------+PS-04(02) Automated Actions
------+PS-05 Personnel Transfer
------+PS-06 Access Agreements
---------+PS-06(02) Classified Information Requiring Special Protection
---------+PS-06(03) Post-employment Requirements
------+PS-07 External Personnel Security
------+PS-08 Personnel Sanctions
------+PS-09 Position Descriptions
---+PT Personally Identifiable Information Processing and Transparency
------+PT-01 Policy and Procedures
------+PT-02 Authority to Process Personally Identifiable Information
---------+PT-02(01) Data Tagging
---------+PT-02(02) Automation
------+PT-03 Personally Identifiable Information Processing Purposes
---------+PT-03(01) Data Tagging
---------+PT-03(02) Automation
------+PT-04 Consent
---------+PT-04(01) Tailored Consent
---------+PT-04(02) Just-in-time Consent
---------+PT-04(03) Revocation
------+PT-05 Privacy Notice
---------+PT-05(01) Just-in-time Notice
---------+PT-05(02) Privacy Act Statements
------+PT-06 System of Records Notice
---------+PT-06(01) Routine Uses
---------+PT-06(02) Exemption Rules
------+PT-07 Specific Categories of Personally Identifiable Information
---------+PT-07(01) Social Security Numbers
---------+PT-07(02) First Amendment Information
------+PT-08 Computer Matching Requirements
---+RA Risk Assessment
------+RA-01 Policy and Procedures
------+RA-02 Security Categorization
---------+RA-02(01) Impact-level Prioritization
------+RA-03 Risk Assessment
---------+RA-03(01) Supply Chain Risk Assessment
---------+RA-03(02) Use of All-source Intelligence
---------+RA-03(03) Dynamic Threat Awareness
---------+RA-03(04) Predictive Cyber Analytics
------+RA-04 Risk Assessment Update
------+RA-05 Vulnerability Monitoring and Scanning
---------+RA-05(02) Update Vulnerabilities to Be Scanned
---------+RA-05(03) Breadth and Depth of Coverage
---------+RA-05(04) Discoverable Information
---------+RA-05(05) Privileged Access
---------+RA-05(06) Automated Trend Analyses
---------+RA-05(08) Review Historic Audit Logs
---------+RA-05(10) Correlate Scanning Information
---------+RA-05(11) Public Disclosure Program
------+RA-06 Technical Surveillance Countermeasures Survey
------+RA-07 Risk Response
------+RA-08 Privacy Impact Assessments
------+RA-09 Criticality Analysis
------+RA-10 Threat Hunting
---+SA System and Services Acquisition
------+SA-01 Policy and Procedures
------+SA-02 Allocation of Resources
------+SA-03 System Development Life Cycle
---------+SA-03(01) Manage Preproduction Environment
---------+SA-03(02) Use of Live or Operational Data
---------+SA-03(03) Technology Refresh
------+SA-04 Acquisition Process
---------+SA-04(01) Functional Properties of Controls
---------+SA-04(02) Design and Implementation Information for Controls
---------+SA-04(03) Development Methods, Techniques, and Practices
---------+SA-04(05) System, Component, and Service Configurations
---------+SA-04(06) Use of Information Assurance Products
---------+SA-04(07) NIAP-approved Protection Profiles
---------+SA-04(08) Continuous Monitoring Plan for Controls
---------+SA-04(09) Functions, Ports, Protocols, and Services in Use
---------+SA-04(10) Use of Approved PIV Products
---------+SA-04(11) System of Records
---------+SA-04(12) Data Ownership
------+SA-05 System Documentation
------+SA-06 Software Usage Restrictions
------+SA-07 User-installed Software
------+SA-08 Security and Privacy Engineering Principles
---------+SA-08(01) Clear Abstractions
---------+SA-08(02) Least Common Mechanism
---------+SA-08(03) Modularity and Layering
---------+SA-08(04) Partially Ordered Dependencies
---------+SA-08(05) Efficiently Mediated Access
---------+SA-08(06) Minimized Sharing
---------+SA-08(07) Reduced Complexity
---------+SA-08(08) Secure Evolvability
---------+SA-08(09) Trusted Components
---------+SA-08(10) Hierarchical Trust
---------+SA-08(11) Inverse Modification Threshold
---------+SA-08(12) Hierarchical Protection
---------+SA-08(13) Minimized Security Elements
---------+SA-08(14) Least Privilege
---------+SA-08(15) Predicate Permission
---------+SA-08(16) Self-reliant Trustworthiness
---------+SA-08(17) Secure Distributed Composition
---------+SA-08(18) Trusted Communications Channels
---------+SA-08(19) Continuous Protection
---------+SA-08(20) Secure Metadata Management
---------+SA-08(21) Self-analysis
---------+SA-08(22) Accountability and Traceability
---------+SA-08(23) Secure Defaults
---------+SA-08(24) Secure Failure and Recovery
---------+SA-08(25) Economic Security
---------+SA-08(26) Performance Security
---------+SA-08(27) Human Factored Security
---------+SA-08(28) Acceptable Security
---------+SA-08(29) Repeatable and Documented Procedures
---------+SA-08(30) Procedural Rigor
---------+SA-08(31) Secure System Modification
---------+SA-08(32) Sufficient Documentation
---------+SA-08(33) Minimization
------+SA-09 External System Services
---------+SA-09(01) Risk Assessments and Organizational Approvals
---------+SA-09(02) Identification of Functions, Ports, Protocols, and Services
---------+SA-09(03) Establish and Maintain Trust Relationship with Providers
---------+SA-09(04) Consistent Interests of Consumers and Providers
---------+SA-09(05) Processing, Storage, and Service Location
---------+SA-09(06) Organization-controlled Cryptographic Keys
---------+SA-09(07) Organization-controlled Integrity Checking
---------+SA-09(08) Processing and Storage Location — U.S. Jurisdiction
------+SA-10 Developer Configuration Management
---------+SA-10(01) Software and Firmware Integrity Verification
---------+SA-10(02) Alternative Configuration Management Processes
---------+SA-10(03) Hardware Integrity Verification
---------+SA-10(04) Trusted Generation
---------+SA-10(05) Mapping Integrity for Version Control
---------+SA-10(06) Trusted Distribution
---------+SA-10(07) Security and Privacy Representatives
------+SA-11 Developer Testing and Evaluation
---------+SA-11(01) Static Code Analysis
---------+SA-11(02) Threat Modeling and Vulnerability Analyses
---------+SA-11(03) Independent Verification of Assessment Plans and Evidence
---------+SA-11(04) Manual Code Reviews
---------+SA-11(05) Penetration Testing
---------+SA-11(06) Attack Surface Reviews
---------+SA-11(07) Verify Scope of Testing and Evaluation
---------+SA-11(08) Dynamic Code Analysis
---------+SA-11(09) Interactive Application Security Testing
------+SA-12 Supply Chain Protection
------+SA-13 Trustworthiness
------+SA-14 Criticality Analysis
------+SA-15 Development Process, Standards, and Tools
---------+SA-15(01) Quality Metrics
---------+SA-15(02) Security and Privacy Tracking Tools
---------+SA-15(03) Criticality Analysis
---------+SA-15(05) Attack Surface Reduction
---------+SA-15(06) Continuous Improvement
---------+SA-15(07) Automated Vulnerability Analysis
---------+SA-15(08) Reuse of Threat and Vulnerability Information
---------+SA-15(10) Incident Response Plan
---------+SA-15(11) Archive System or Component
---------+SA-15(12) Minimize Personally Identifiable Information
---------+SA-15(13) Logging Syntax
------+SA-16 Developer-provided Training
------+SA-17 Developer Security and Privacy Architecture and Design
---------+SA-17(01) Formal Policy Model
---------+SA-17(02) Security-relevant Components
---------+SA-17(03) Formal Correspondence
---------+SA-17(04) Informal Correspondence
---------+SA-17(05) Conceptually Simple Design
---------+SA-17(06) Structure for Testing
---------+SA-17(07) Structure for Least Privilege
---------+SA-17(08) Orchestration
---------+SA-17(09) Design Diversity
------+SA-18 Tamper Resistance and Detection
------+SA-19 Component Authenticity
------+SA-20 Customized Development of Critical Components
------+SA-21 Developer Screening
------+SA-22 Unsupported System Components
------+SA-23 Specialization
------+SA-24 Design For Cyber Resiliency
---+SC System and Communications Protection
------+SC-01 Policy and Procedures
------+SC-02 Separation of System and User Functionality
---------+SC-02(01) Interfaces for Non-privileged Users
---------+SC-02(02) Disassociability
------+SC-03 Security Function Isolation
---------+SC-03(01) Hardware Separation
---------+SC-03(02) Access and Flow Control Functions
---------+SC-03(03) Minimize Nonsecurity Functionality
---------+SC-03(04) Module Coupling and Cohesiveness
---------+SC-03(05) Layered Structures
------+SC-04 Information in Shared System Resources
---------+SC-04(02) Multilevel or Periods Processing
------+SC-05 Denial-of-service Protection
---------+SC-05(01) Restrict Ability to Attack Other Systems
---------+SC-05(02) Capacity, Bandwidth, and Redundancy
---------+SC-05(03) Detection and Monitoring
------+SC-06 Resource Availability
------+SC-07 Boundary Protection
---------+SC-07(03) Access Points
---------+SC-07(04) External Telecommunications Services
---------+SC-07(05) Deny by Default — Allow by Exception
---------+SC-07(07) Split Tunneling for Remote Devices
---------+SC-07(08) Route Traffic to Authenticated Proxy Servers
---------+SC-07(09) Restrict Threatening Outgoing Communications Traffic
---------+SC-07(10) Prevent Exfiltration
---------+SC-07(11) Restrict Incoming Communications Traffic
---------+SC-07(12) Host-based Protection
---------+SC-07(13) Isolation of Security Tools, Mechanisms, and Support Components
---------+SC-07(14) Protect Against Unauthorized Physical Connections
---------+SC-07(15) Networked Privileged Accesses
---------+SC-07(16) Prevent Discovery of System Components
---------+SC-07(17) Automated Enforcement of Protocol Formats
---------+SC-07(18) Fail Secure
---------+SC-07(19) Block Communication from Non-organizationally Configured Hosts
---------+SC-07(20) Dynamic Isolation and Segregation
---------+SC-07(21) Isolation of System Components
---------+SC-07(22) Separate Subnets for Connecting to Different Security Domains
---------+SC-07(23) Disable Sender Feedback on Protocol Validation Failure
---------+SC-07(24) Personally Identifiable Information
---------+SC-07(25) Unclassified National Security System Connections
---------+SC-07(26) Classified National Security System Connections
---------+SC-07(27) Unclassified Non-national Security System Connections
---------+SC-07(28) Connections to Public Networks
---------+SC-07(29) Separate Subnets to Isolate Functions
------+SC-08 Transmission Confidentiality and Integrity
---------+SC-08(01) Cryptographic Protection
---------+SC-08(02) Pre- and Post-transmission Handling
---------+SC-08(03) Cryptographic Protection for Message Externals
---------+SC-08(04) Conceal or Randomize Communications
---------+SC-08(05) Protected Distribution System
------+SC-09 Transmission Confidentiality
------+SC-10 Network Disconnect
------+SC-11 Trusted Path
---------+SC-11(01) Irrefutable Communications Path
------+SC-12 Cryptographic Key Establishment and Management
---------+SC-12(01) Availability
---------+SC-12(02) Symmetric Keys
---------+SC-12(03) Asymmetric Keys
---------+SC-12(06) Physical Control of Keys
------+SC-13 Cryptographic Protection
------+SC-14 Public Access Protections
------+SC-15 Collaborative Computing Devices and Applications
---------+SC-15(01) Physical or Logical Disconnect
---------+SC-15(03) Disabling and Removal in Secure Work Areas
---------+SC-15(04) Explicitly Indicate Current Participants
------+SC-16 Transmission of Security and Privacy Attributes
---------+SC-16(01) Integrity Verification
---------+SC-16(02) Anti-spoofing Mechanisms
---------+SC-16(03) Cryptographic Binding
------+SC-17 Public Key Infrastructure Certificates
------+SC-18 Mobile Code
---------+SC-18(01) Identify Unacceptable Code and Take Corrective Actions
---------+SC-18(02) Acquisition, Development, and Use
---------+SC-18(03) Prevent Downloading and Execution
---------+SC-18(04) Prevent Automatic Execution
---------+SC-18(05) Allow Execution Only in Confined Environments
------+SC-19 Voice Over Internet Protocol
------+SC-20 Secure Name/Address Resolution Service (Authoritative Source)
---------+SC-20(02) Data Origin and Integrity
------+SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
------+SC-22 Architecture and Provisioning for Name/Address Resolution Service
------+SC-23 Session Authenticity
---------+SC-23(01) Invalidate Session Identifiers at Logout
---------+SC-23(03) Unique System-generated Session Identifiers
---------+SC-23(05) Allowed Certificate Authorities
------+SC-24 Fail in Known State
------+SC-25 Thin Nodes
------+SC-26 Decoys
------+SC-27 Platform-independent Applications
------+SC-28 Protection of Information at Rest
---------+SC-28(01) Cryptographic Protection
---------+SC-28(02) Offline Storage
---------+SC-28(03) Cryptographic Keys
------+SC-29 Heterogeneity
---------+SC-29(01) Virtualization Techniques
------+SC-30 Concealment and Misdirection
---------+SC-30(02) Randomness
---------+SC-30(03) Change Processing and Storage Locations
---------+SC-30(04) Misleading Information
---------+SC-30(05) Concealment of System Components
------+SC-31 Covert Channel Analysis
---------+SC-31(01) Test Covert Channels for Exploitability
---------+SC-31(02) Maximum Bandwidth
---------+SC-31(03) Measure Bandwidth in Operational Environments
------+SC-32 System Partitioning
---------+SC-32(01) Separate Physical Domains for Privileged Functions
------+SC-33 Transmission Preparation Integrity
------+SC-34 Non-modifiable Executable Programs
---------+SC-34(01) No Writable Storage
---------+SC-34(02) Integrity Protection on Read-only Media
------+SC-35 External Malicious Code Identification
------+SC-36 Distributed Processing and Storage
---------+SC-36(01) Polling Techniques
---------+SC-36(02) Synchronization
------+SC-37 Out-of-band Channels
---------+SC-37(01) Ensure Delivery and Transmission
------+SC-38 Operations Security
------+SC-39 Process Isolation
---------+SC-39(01) Hardware Separation
---------+SC-39(02) Separate Execution Domain Per Thread
------+SC-40 Wireless Link Protection
---------+SC-40(01) Electromagnetic Interference
---------+SC-40(02) Reduce Detection Potential
---------+SC-40(03) Imitative or Manipulative Communications Deception
---------+SC-40(04) Signal Parameter Identification
------+SC-41 Port and I/O Device Access
------+SC-42 Sensor Capability and Data
---------+SC-42(01) Reporting to Authorized Individuals or Roles
---------+SC-42(02) Authorized Use
---------+SC-42(04) Notice of Collection
---------+SC-42(05) Collection Minimization
------+SC-43 Usage Restrictions
------+SC-44 Detonation Chambers
------+SC-45 System Time Synchronization
---------+SC-45(01) Synchronization with Authoritative Time Source
---------+SC-45(02) Secondary Authoritative Time Source
------+SC-46 Cross Domain Policy Enforcement
------+SC-47 Alternate Communications Paths
------+SC-48 Sensor Relocation
---------+SC-48(01) Dynamic Relocation of Sensors or Monitoring Capabilities
------+SC-49 Hardware-enforced Separation and Policy Enforcement
------+SC-50 Software-enforced Separation and Policy Enforcement
------+SC-51 Hardware-based Protection
---+SI System and Information Integrity
------+SI-01 Policy and Procedures
------+SI-02 Flaw Remediation
---------+SI-02(02) Automated Flaw Remediation Status
---------+SI-02(03) Time to Remediate Flaws and Benchmarks for Corrective Actions
---------+SI-02(04) Automated Patch Management Tools
---------+SI-02(05) Automatic Software and Firmware Updates
---------+SI-02(06) Removal of Previous Versions of Software and Firmware
---------+SI-02(07) Root Cause Analysis
------+SI-03 Malicious Code Protection
---------+SI-03(04) Updates Only by Privileged Users
---------+SI-03(06) Testing and Verification
---------+SI-03(08) Detect Unauthorized Commands
---------+SI-03(10) Malicious Code Analysis
------+SI-04 System Monitoring
---------+SI-04(01) System-wide Intrusion Detection System
---------+SI-04(02) Automated Tools and Mechanisms for Real-time Analysis
---------+SI-04(03) Automated Tool and Mechanism Integration
---------+SI-04(04) Inbound and Outbound Communications Traffic
---------+SI-04(05) System-generated Alerts
---------+SI-04(07) Automated Response to Suspicious Events
---------+SI-04(09) Testing of Monitoring Tools and Mechanisms
---------+SI-04(10) Visibility of Encrypted Communications
---------+SI-04(11) Analyze Communications Traffic Anomalies
---------+SI-04(12) Automated Organization-generated Alerts
---------+SI-04(13) Analyze Traffic and Event Patterns
---------+SI-04(14) Wireless Intrusion Detection
---------+SI-04(15) Wireless to Wireline Communications
---------+SI-04(16) Correlate Monitoring Information
---------+SI-04(17) Integrated Situational Awareness
---------+SI-04(18) Analyze Traffic and Covert Exfiltration
---------+SI-04(19) Risk for Individuals
---------+SI-04(20) Privileged Users
---------+SI-04(21) Probationary Periods
---------+SI-04(22) Unauthorized Network Services
---------+SI-04(23) Host-based Devices
---------+SI-04(24) Indicators of Compromise
---------+SI-04(25) Optimize Network Traffic Analysis
------+SI-05 Security Alerts, Advisories, and Directives
---------+SI-05(01) Automated Alerts and Advisories
------+SI-06 Security and Privacy Function Verification
---------+SI-06(02) Automation Support for Distributed Testing
---------+SI-06(03) Report Verification Results
------+SI-07 Software, Firmware, and Information Integrity
---------+SI-07(01) Integrity Checks
---------+SI-07(02) Automated Notifications of Integrity Violations
---------+SI-07(03) Centrally Managed Integrity Tools
---------+SI-07(05) Automated Response to Integrity Violations
---------+SI-07(06) Cryptographic Protection
---------+SI-07(07) Integration of Detection and Response
---------+SI-07(08) Auditing Capability for Significant Events
---------+SI-07(09) Verify Boot Process
---------+SI-07(10) Protection of Boot Firmware
---------+SI-07(12) Integrity Verification
---------+SI-07(15) Code Authentication
---------+SI-07(16) Time Limit on Process Execution Without Supervision
---------+SI-07(17) Runtime Application Self-protection
------+SI-08 Spam Protection
---------+SI-08(02) Automatic Updates
---------+SI-08(03) Continuous Learning Capability
------+SI-09 Information Input Restrictions
------+SI-10 Information Input Validation
---------+SI-10(01) Manual Override Capability
---------+SI-10(02) Review and Resolve Errors
---------+SI-10(03) Predictable Behavior
---------+SI-10(04) Timing Interactions
---------+SI-10(05) Restrict Inputs to Trusted Sources and Approved Formats
---------+SI-10(06) Injection Prevention
------+SI-11 Error Handling
------+SI-12 Information Management and Retention
---------+SI-12(01) Limit Personally Identifiable Information Elements
---------+SI-12(02) Minimize Personally Identifiable Information in Testing, Training, and Research
---------+SI-12(03) Information Disposal
------+SI-13 Predictable Failure Prevention
---------+SI-13(01) Transferring Component Responsibilities
---------+SI-13(03) Manual Transfer Between Components
---------+SI-13(04) Standby Component Installation and Notification
---------+SI-13(05) Failover Capability
------+SI-14 Non-persistence
---------+SI-14(01) Refresh from Trusted Sources
---------+SI-14(02) Non-persistent Information
---------+SI-14(03) Non-persistent Connectivity
------+SI-15 Information Output Filtering
------+SI-16 Memory Protection
------+SI-17 Fail-safe Procedures
------+SI-18 Personally Identifiable Information Quality Operations
---------+SI-18(01) Automation Support
---------+SI-18(02) Data Tags
---------+SI-18(03) Collection
---------+SI-18(04) Individual Requests
---------+SI-18(05) Notice of Correction or Deletion
------+SI-19 De-identification
---------+SI-19(01) Collection
---------+SI-19(02) Archiving
---------+SI-19(03) Release
---------+SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
---------+SI-19(05) Statistical Disclosure Control
---------+SI-19(06) Differential Privacy
---------+SI-19(07) Validated Algorithms and Software
---------+SI-19(08) Motivated Intruder
------+SI-20 Tainting
------+SI-21 Information Refresh
------+SI-22 Information Diversity
------+SI-23 Information Fragmentation
---+SR Supply Chain Risk Management
------+SR-01 Policy and Procedures
------+SR-02 Supply Chain Risk Management Plan
---------+SR-02(01) Establish SCRM Team
------+SR-03 Supply Chain Controls and Processes
---------+SR-03(01) Diverse Supply Base
---------+SR-03(02) Limitation of Harm
---------+SR-03(03) Sub-tier Flow Down
------+SR-04 Provenance
---------+SR-04(01) Identity
---------+SR-04(02) Track and Trace
---------+SR-04(03) Validate as Genuine and Not Altered
---------+SR-04(04) Supply Chain Integrity — Pedigree
------+SR-05 Acquisition Strategies, Tools, and Methods
---------+SR-05(01) Adequate Supply
---------+SR-05(02) Assessments Prior to Selection, Acceptance, Modification, or Update
------+SR-06 Supplier Assessments and Reviews
---------+SR-06(01) Testing and Analysis
------+SR-07 Supply Chain Operations Security
------+SR-08 Notification Agreements
------+SR-09 Tamper Resistance and Detection
---------+SR-09(01) Multiple Stages of System Development Life Cycle
------+SR-10 Inspection of Systems or Components
------+SR-11 Component Authenticity
---------+SR-11(01) Anti-counterfeit Training
---------+SR-11(02) Configuration Control for Component Service and Repair
---------+SR-11(03) Anti-counterfeit Scanning
------+SR-12 Component Disposal
---+NIST SP 800-53 Rev. 5 – Assessment Procedures
------+AC-01 Policy and Procedures – Assessment Procedure
------+AC-02 Account Management – Assessment Procedure
------+AC-02(01) Automated System Account Management – Assessment Procedure
------+AC-02(02) Automated Temporary and Emergency Account Management – Assessment Procedure
------+AC-02(03) Disable Accounts – Assessment Procedure
------+AC-02(04) Automated Audit Actions – Assessment Procedure
------+AC-02(05) Inactivity Logout – Assessment Procedure
------+AC-02(06) Dynamic Privilege Management – Assessment Procedure
------+AC-02(07) Privileged User Accounts – Assessment Procedure
------+AC-02(08) Dynamic Account Management – Assessment Procedure
------+AC-02(09) Restrictions on Use of Shared and Group Accounts – Assessment Procedure
------+AC-02(11) Usage Conditions – Assessment Procedure
------+AC-02(12) Account Monitoring for Atypical Usage – Assessment Procedure
------+AC-02(13) Disable Accounts for High-risk Individuals – Assessment Procedure
------+AC-03 Access Enforcement – Assessment Procedure
------+AC-03(02) Dual Authorization – Assessment Procedure
------+AC-03(03) Mandatory Access Control – Assessment Procedure
------+AC-03(04) Discretionary Access Control – Assessment Procedure
------+AC-03(05) Security-relevant Information – Assessment Procedure
------+AC-03(07) Role-based Access Control – Assessment Procedure
------+AC-03(08) Revocation of Access Authorizations – Assessment Procedure
------+AC-03(09) Controlled Release – Assessment Procedure
------+AC-03(10) Audited Override of Access Control Mechanisms – Assessment Procedure
------+AC-03(11) Restrict Access to Specific Information Types – Assessment Procedure
------+AC-03(12) Assert and Enforce Application Access – Assessment Procedure
------+AC-03(13) Attribute-based Access Control – Assessment Procedure
------+AC-03(14) Individual Access – Assessment Procedure
------+AC-03(15) Discretionary and Mandatory Access Control – Assessment Procedure
------+AC-04 Information Flow Enforcement – Assessment Procedure
------+AC-04(01) Object Security and Privacy Attributes – Assessment Procedure
------+AC-04(02) Processing Domains – Assessment Procedure
------+AC-04(03) Dynamic Information Flow Control – Assessment Procedure
------+AC-04(04) Flow Control of Encrypted Information – Assessment Procedure
------+AC-04(05) Embedded Data Types – Assessment Procedure
------+AC-04(06) Metadata – Assessment Procedure
------+AC-04(07) One-way Flow Mechanisms – Assessment Procedure
------+AC-04(08) Security and Privacy Policy Filters – Assessment Procedure
------+AC-04(09) Human Reviews – Assessment Procedure
------+AC-04(10) Enable and Disable Security or Privacy Policy Filters – Assessment Procedure
------+AC-04(11) Configuration of Security or Privacy Policy Filters – Assessment Procedure
------+AC-04(12) Data Type Identifiers – Assessment Procedure
------+AC-04(13) Decomposition into Policy-relevant Subcomponents – Assessment Procedure
------+AC-04(14) Security or Privacy Policy Filter Constraints – Assessment Procedure
------+AC-04(15) Detection of Unsanctioned Information – Assessment Procedure
------+AC-04(17) Domain Authentication – Assessment Procedure
------+AC-04(19) Validation of Metadata – Assessment Procedure
------+AC-04(20) Approved Solutions – Assessment Procedure
------+AC-04(21) Physical or Logical Separation of Information Flows – Assessment Procedure
------+AC-04(22) Access Only – Assessment Procedure
------+AC-04(23) Modify Non-releasable Information – Assessment Procedure
------+AC-04(24) Internal Normalized Format – Assessment Procedure
------+AC-04(25) Data Sanitization – Assessment Procedure
------+AC-04(26) Audit Filtering Actions – Assessment Procedure
------+AC-04(27) Redundant/Independent Filtering Mechanisms – Assessment Procedure
------+AC-04(28) Linear Filter Pipelines – Assessment Procedure
------+AC-04(29) Filter Orchestration Engines – Assessment Procedure
------+AC-04(30) Filter Mechanisms Using Multiple Processes – Assessment Procedure
------+AC-04(31) Failed Content Transfer Prevention – Assessment Procedure
------+AC-04(32) Process Requirements for Information Transfer – Assessment Procedure
------+AC-05 Separation of Duties – Assessment Procedure
------+AC-06 Least Privilege – Assessment Procedure
------+AC-06(01) Authorize Access to Security Functions – Assessment Procedure
------+AC-06(02) Non-privileged Access for Nonsecurity Functions – Assessment Procedure
------+AC-06(03) Network Access to Privileged Commands – Assessment Procedure
------+AC-06(04) Separate Processing Domains – Assessment Procedure
------+AC-06(05) Privileged Accounts – Assessment Procedure
------+AC-06(06) Privileged Access by Non-organizational Users – Assessment Procedure
------+AC-06(07) Review of User Privileges – Assessment Procedure
------+AC-06(08) Privilege Levels for Code Execution – Assessment Procedure
------+AC-06(09) Log Use of Privileged Functions – Assessment Procedure
------+AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions – Assessment Procedure
------+AC-07 Unsuccessful Logon Attempts – Assessment Procedure
------+AC-07(02) Purge or Wipe Mobile Device – Assessment Procedure
------+AC-07(03) Biometric Attempt Limiting – Assessment Procedure
------+AC-07(04) Use of Alternate Authentication Factor – Assessment Procedure
------+AC-08 System Use Notification – Assessment Procedure
------+AC-09 Previous Logon Notification – Assessment Procedure
------+AC-09(01) Unsuccessful Logons – Assessment Procedure
------+AC-09(02) Successful and Unsuccessful Logons – Assessment Procedure
------+AC-09(03) Notification of Account Changes – Assessment Procedure
------+AC-09(04) Additional Logon Information – Assessment Procedure
------+AC-10 Concurrent Session Control – Assessment Procedure
------+AC-11 Device Lock – Assessment Procedure
------+AC-11(01) Pattern-hiding Displays – Assessment Procedure
------+AC-12 Session Termination – Assessment Procedure
------+AC-12(01) User-initiated Logouts – Assessment Procedure
------+AC-12(02) Termination Message – Assessment Procedure
------+AC-12(03) Timeout Warning Message – Assessment Procedure
------+AC-14 Permitted Actions Without Identification or Authentication – Assessment Procedure
------+AC-16 Security and Privacy Attributes – Assessment Procedure
------+AC-16(01) Dynamic Attribute Association – Assessment Procedure
------+AC-16(02) Attribute Value Changes by Authorized Individuals – Assessment Procedure
------+AC-16(03) Maintenance of Attribute Associations by System – Assessment Procedure
------+AC-16(04) Association of Attributes by Authorized Individuals – Assessment Procedure
------+AC-16(05) Attribute Displays on Objects to Be Output – Assessment Procedure
------+AC-16(06) Maintenance of Attribute Association – Assessment Procedure
------+AC-16(07) Consistent Attribute Interpretation – Assessment Procedure
------+AC-16(08) Association Techniques and Technologies – Assessment Procedure
------+AC-16(09) Attribute Reassignment — Regrading Mechanisms – Assessment Procedure
------+AC-16(10) Attribute Configuration by Authorized Individuals – Assessment Procedure
------+AC-17 Remote Access – Assessment Procedure
------+AC-17(01) Monitoring and Control – Assessment Procedure
------+AC-17(02) Protection of Confidentiality and Integrity Using Encryption – Assessment Procedure
------+AC-17(03) Managed Access Control Points – Assessment Procedure
------+AC-17(04) Privileged Commands and Access – Assessment Procedure
------+AC-17(06) Protection of Mechanism Information – Assessment Procedure
------+AC-17(09) Disconnect or Disable Access – Assessment Procedure
------+AC-17(10) Authenticate Remote Commands – Assessment Procedure
------+AC-18 Wireless Access – Assessment Procedure
------+AC-18(01) Authentication and Encryption – Assessment Procedure
------+AC-18(03) Disable Wireless Networking – Assessment Procedure
------+AC-18(04) Restrict Configurations by Users – Assessment Procedure
------+AC-18(05) Antennas and Transmission Power Levels – Assessment Procedure
------+AC-19 Access Control for Mobile Devices – Assessment Procedure
------+AC-19(04) Restrictions for Classified Information – Assessment Procedure
------+AC-19(05) Full Device or Container-based Encryption – Assessment Procedure
------+AC-20 Use of External Systems – Assessment Procedure
------+AC-20(01) Limits on Authorized Use – Assessment Procedure
------+AC-20(02) Portable Storage Devices — Restricted Use – Assessment Procedure
------+AC-20(03) Non-organizationally Owned Systems — Restricted Use – Assessment Procedure
------+AC-20(04) Network Accessible Storage Devices — Prohibited Use – Assessment Procedure
------+AC-20(05) Portable Storage Devices — Prohibited Use – Assessment Procedure
------+AC-21 Information Sharing – Assessment Procedure
------+AC-21(01) Automated Decision Support – Assessment Procedure
------+AC-21(02) Information Search and Retrieval – Assessment Procedure
------+AC-22 Publicly Accessible Content – Assessment Procedure
------+AC-23 Data Mining Protection – Assessment Procedure
------+AC-24 Access Control Decisions – Assessment Procedure
------+AC-24(01) Transmit Access Authorization Information – Assessment Procedure
------+AC-24(02) No User or Process Identity – Assessment Procedure
------+AC-25 Reference Monitor – Assessment Procedure
------+AT-01 Policy and Procedures – Assessment Procedure
------+AT-02 Literacy Training and Awareness – Assessment Procedure
------+AT-02(01) Practical Exercises – Assessment Procedure
------+AT-02(02) Insider Threat – Assessment Procedure
------+AT-02(03) Social Engineering and Mining – Assessment Procedure
------+AT-02(04) Suspicious Communications and Anomalous System Behavior – Assessment Procedure
------+AT-02(05) Advanced Persistent Threat – Assessment Procedure
------+AT-02(06) Cyber Threat Environment – Assessment Procedure
------+AT-03 Role-based Training – Assessment Procedure
------+AT-03(01) Environmental Controls – Assessment Procedure
------+AT-03(02) Physical Security Controls – Assessment Procedure
------+AT-03(03) Practical Exercises – Assessment Procedure
------+AT-03(05) Processing Personally Identifiable Information – Assessment Procedure
------+AT-04 Training Records – Assessment Procedure
------+AT-06 Training Feedback – Assessment Procedure
------+AU-01 Policy and Procedures – Assessment Procedure
------+AU-02 Event Logging – Assessment Procedure
------+AU-03 Content of Audit Records – Assessment Procedure
------+AU-03(01) Additional Audit Information – Assessment Procedure
------+AU-03(03) Limit Personally Identifiable Information Elements – Assessment Procedure
------+AU-04 Audit Log Storage Capacity – Assessment Procedure
------+AU-04(01) Transfer to Alternate Storage – Assessment Procedure
------+AU-05 Response to Audit Logging Process Failures – Assessment Procedure
------+AU-05(01) Storage Capacity Warning – Assessment Procedure
------+AU-05(02) Real-time Alerts – Assessment Procedure
------+AU-05(03) Configurable Traffic Volume Thresholds – Assessment Procedure
------+AU-05(04) Shutdown on Failure – Assessment Procedure
------+AU-05(05) Alternate Audit Logging Capability – Assessment Procedure
------+AU-06 Audit Record Review, Analysis, and Reporting – Assessment Procedure
------+AU-06(01) Automated Process Integration – Assessment Procedure
------+AU-06(03) Correlate Audit Record Repositories – Assessment Procedure
------+AU-06(04) Central Review and Analysis – Assessment Procedure
------+AU-06(05) Integrated Analysis of Audit Records – Assessment Procedure
------+AU-06(06) Correlation with Physical Monitoring – Assessment Procedure
------+AU-06(07) Permitted Actions – Assessment Procedure
------+AU-06(08) Full Text Analysis of Privileged Commands – Assessment Procedure
------+AU-06(09) Correlation with Information from Nontechnical Sources – Assessment Procedure
------+AU-07 Audit Record Reduction and Report Generation – Assessment Procedure
------+AU-07(01) Automatic Processing – Assessment Procedure
------+AU-08 Time Stamps – Assessment Procedure
------+AU-09 Protection of Audit Information – Assessment Procedure
------+AU-09(01) Hardware Write-once Media – Assessment Procedure
------+AU-09(02) Store on Separate Physical Systems or Components – Assessment Procedure
------+AU-09(03) Cryptographic Protection – Assessment Procedure
------+AU-09(04) Access by Subset of Privileged Users – Assessment Procedure
------+AU-09(05) Dual Authorization – Assessment Procedure
------+AU-09(06) Read-only Access – Assessment Procedure
------+AU-09(07) Store on Component with Different Operating System – Assessment Procedure
------+AU-10 Non-repudiation – Assessment Procedure
------+AU-10(01) Association of Identities – Assessment Procedure
------+AU-10(02) Validate Binding of Information Producer Identity – Assessment Procedure
------+AU-10(03) Chain of Custody – Assessment Procedure
------+AU-10(04) Validate Binding of Information Reviewer Identity – Assessment Procedure
------+AU-11 Audit Record Retention – Assessment Procedure
------+AU-11(01) Long-term Retrieval Capability – Assessment Procedure
------+AU-12 Audit Record Generation – Assessment Procedure
------+AU-12(01) System-wide and Time-correlated Audit Trail – Assessment Procedure
------+AU-12(02) Standardized Formats – Assessment Procedure
------+AU-12(03) Changes by Authorized Individuals – Assessment Procedure
------+AU-12(04) Query Parameter Audits of Personally Identifiable Information – Assessment Procedure
------+AU-13 Monitoring for Information Disclosure – Assessment Procedure
------+AU-13(01) Use of Automated Tools – Assessment Procedure
------+AU-13(02) Review of Monitored Sites – Assessment Procedure
------+AU-13(03) Unauthorized Replication of Information – Assessment Procedure
------+AU-14 Session Audit – Assessment Procedure
------+AU-14(01) System Start-up – Assessment Procedure
------+AU-14(03) Remote Viewing and Listening – Assessment Procedure
------+AU-16 Cross-organizational Audit Logging – Assessment Procedure
------+AU-16(01) Identity Preservation – Assessment Procedure
------+AU-16(02) Sharing of Audit Information – Assessment Procedure
------+AU-16(03) Disassociability – Assessment Procedure
------+CA-01 Policy and Procedures – Assessment Procedure
------+CA-02 Control Assessments – Assessment Procedure
------+CA-02(01) Independent Assessors – Assessment Procedure
------+CA-02(02) Specialized Assessments – Assessment Procedure
------+CA-02(03) Leveraging Results from External Organizations – Assessment Procedure
------+CA-03 Information Exchange – Assessment Procedure
------+CA-03(06) Transfer Authorizations – Assessment Procedure
------+CA-03(07) Transitive Information Exchanges – Assessment Procedure
------+CA-05 Plan of Action and Milestones – Assessment Procedure
------+CA-05(01) Automation Support for Accuracy and Currency – Assessment Procedure
------+CA-06 Authorization – Assessment Procedure
------+CA-06(01) Joint Authorization — Intra-organization – Assessment Procedure
------+CA-06(02) Joint Authorization — Inter-organization – Assessment Procedure
------+CA-07 Continuous Monitoring – Assessment Procedure
------+CA-07(01) Independent Assessment – Assessment Procedure
------+CA-07(03) Trend Analyses – Assessment Procedure
------+CA-07(04) Risk Monitoring – Assessment Procedure
------+CA-07(05) Consistency Analysis – Assessment Procedure
------+CA-07(06) Automation Support for Monitoring – Assessment Procedure
------+CA-08 Penetration Testing – Assessment Procedure
------+CA-08(01) Independent Penetration Testing Agent or Team – Assessment Procedure
------+CA-08(02) Red Team Exercises – Assessment Procedure
------+CA-08(03) Facility Penetration Testing – Assessment Procedure
------+CA-09 Internal System Connections – Assessment Procedure
------+CA-09(01) Compliance Checks – Assessment Procedure
------+CM-01 Policy and Procedures – Assessment Procedure
------+CM-02 Baseline Configuration – Assessment Procedure
------+CM-02(02) Automation Support for Accuracy and Currency – Assessment Procedure
------+CM-02(03) Retention of Previous Configurations – Assessment Procedure
------+CM-02(06) Development and Test Environments – Assessment Procedure
------+CM-02(07) Configure Systems and Components for High-risk Areas – Assessment Procedure
------+CM-03 Configuration Change Control – Assessment Procedure
------+CM-03(01) Automated Documentation, Notification, and Prohibition of Changes – Assessment Procedure
------+CM-03(02) Testing, Validation, and Documentation of Changes – Assessment Procedure
------+CM-03(03) Automated Change Implementation – Assessment Procedure
------+CM-03(04) Security and Privacy Representatives – Assessment Procedure
------+CM-03(05) Automated Security Response – Assessment Procedure
------+CM-03(06) Cryptography Management – Assessment Procedure
------+CM-03(07) Review System Changes – Assessment Procedure
------+CM-03(08) Prevent or Restrict Configuration Changes – Assessment Procedure
------+CM-04 Impact Analyses – Assessment Procedure
------+CM-04(01) Separate Test Environments – Assessment Procedure
------+CM-04(02) Verification of Controls – Assessment Procedure
------+CM-05 Access Restrictions for Change – Assessment Procedure
------+CM-05(01) Automated Access Enforcement and Audit Records – Assessment Procedure
------+CM-05(04) Dual Authorization – Assessment Procedure
------+CM-05(05) Privilege Limitation for Production and Operation – Assessment Procedure
------+CM-05(06) Limit Library Privileges – Assessment Procedure
------+CM-06 Configuration Settings – Assessment Procedure
------+CM-06(01) Automated Management, Application, and Verification – Assessment Procedure
------+CM-06(02) Respond to Unauthorized Changes – Assessment Procedure
------+CM-07 Least Functionality – Assessment Procedure
------+CM-07(01) Periodic Review – Assessment Procedure
------+CM-07(02) Prevent Program Execution – Assessment Procedure
------+CM-07(03) Registration Compliance – Assessment Procedure
------+CM-07(04) Unauthorized Software — Deny-by-exception – Assessment Procedure
------+CM-07(05) Authorized Software — Allow-by-exception – Assessment Procedure
------+CM-07(06) Confined Environments with Limited Privileges – Assessment Procedure
------+CM-07(07) Code Execution in Protected Environments – Assessment Procedure
------+CM-07(08) Binary or Machine Executable Code – Assessment Procedure
------+CM-07(09) Prohibiting The Use of Unauthorized Hardware – Assessment Procedure
------+CM-08 System Component Inventory – Assessment Procedure
------+CM-08(01) Updates During Installation and Removal – Assessment Procedure
------+CM-08(02) Automated Maintenance – Assessment Procedure
------+CM-08(03) Automated Unauthorized Component Detection – Assessment Procedure
------+CM-08(04) Accountability Information – Assessment Procedure
------+CM-08(06) Assessed Configurations and Approved Deviations – Assessment Procedure
------+CM-08(07) Centralized Repository – Assessment Procedure
------+CM-08(08) Automated Location Tracking – Assessment Procedure
------+CM-08(09) Assignment of Components to Systems – Assessment Procedure
------+CM-09 Configuration Management Plan – Assessment Procedure
------+CM-09(01) Assignment of Responsibility – Assessment Procedure
------+CM-10 Software Usage Restrictions – Assessment Procedure
------+CM-10(01) Open-source Software – Assessment Procedure
------+CM-11 User-installed Software – Assessment Procedure
------+CM-11(02) Software Installation with Privileged Status – Assessment Procedure
------+CM-11(03) Automated Enforcement and Monitoring – Assessment Procedure
------+CM-12 Information Location – Assessment Procedure
------+CM-12(01) Automated Tools to Support Information Location – Assessment Procedure
------+CM-13 Data Action Mapping – Assessment Procedure
------+CM-14 Signed Components – Assessment Procedure
------+CP-01 Policy and Procedures – Assessment Procedure
------+CP-02 Contingency Plan – Assessment Procedure
------+CP-02(01) Coordinate with Related Plans – Assessment Procedure
------+CP-02(02) Capacity Planning – Assessment Procedure
------+CP-02(03) Resume Mission and Business Functions – Assessment Procedure
------+CP-02(05) Continue Mission and Business Functions – Assessment Procedure
------+CP-02(06) Alternate Processing and Storage Sites – Assessment Procedure
------+CP-02(07) Coordinate with External Service Providers – Assessment Procedure
------+CP-02(08) Identify Critical Assets – Assessment Procedure
------+CP-03 Contingency Training – Assessment Procedure
------+CP-03(01) Simulated Events – Assessment Procedure
------+CP-03(02) Mechanisms Used in Training Environments – Assessment Procedure
------+CP-04 Contingency Plan Testing – Assessment Procedure
------+CP-04(01) Coordinate with Related Plans – Assessment Procedure
------+CP-04(02) Alternate Processing Site – Assessment Procedure
------+CP-04(03) Automated Testing – Assessment Procedure
------+CP-04(04) Full Recovery and Reconstitution – Assessment Procedure
------+CP-04(05) Self-challenge – Assessment Procedure
------+CP-06 Alternate Storage Site – Assessment Procedure
------+CP-06(01) Separation from Primary Site – Assessment Procedure
------+CP-06(02) Recovery Time and Recovery Point Objectives – Assessment Procedure
------+CP-06(03) Accessibility – Assessment Procedure
------+CP-07 Alternate Processing Site – Assessment Procedure
------+CP-07(01) Separation from Primary Site – Assessment Procedure
------+CP-07(02) Accessibility – Assessment Procedure
------+CP-07(03) Priority of Service – Assessment Procedure
------+CP-07(04) Preparation for Use – Assessment Procedure
------+CP-07(06) Inability to Return to Primary Site – Assessment Procedure
------+CP-08 Telecommunications Services – Assessment Procedure
------+CP-08(01) Priority of Service Provisions – Assessment Procedure
------+CP-08(02) Single Points of Failure – Assessment Procedure
------+CP-08(03) Separation of Primary and Alternate Providers – Assessment Procedure
------+CP-08(04) Provider Contingency Plan – Assessment Procedure
------+CP-08(05) Alternate Telecommunication Service Testing – Assessment Procedure
------+CP-09 System Backup – Assessment Procedure
------+CP-09(01) Testing for Reliability and Integrity – Assessment Procedure
------+CP-09(02) Test Restoration Using Sampling – Assessment Procedure
------+CP-09(03) Separate Storage for Critical Information – Assessment Procedure
------+CP-09(05) Transfer to Alternate Storage Site – Assessment Procedure
------+CP-09(06) Redundant Secondary System – Assessment Procedure
------+CP-09(07) Dual Authorization for Deletion or Destruction – Assessment Procedure
------+CP-09(08) Cryptographic Protection – Assessment Procedure
------+CP-10 System Recovery and Reconstitution – Assessment Procedure
------+CP-10(02) Transaction Recovery – Assessment Procedure
------+CP-10(04) Restore Within Time Period – Assessment Procedure
------+CP-10(06) Component Protection – Assessment Procedure
------+CP-11 Alternate Communications Protocols – Assessment Procedure
------+CP-12 Safe Mode – Assessment Procedure
------+CP-13 Alternative Security Mechanisms – Assessment Procedure
------+IA-01 Policy and Procedures – Assessment Procedure
------+IA-02 Identification and Authentication (Organizational Users) – Assessment Procedure
------+IA-02(01) Multi-factor Authentication to Privileged Accounts – Assessment Procedure
------+IA-02(02) Multi-factor Authentication to Non-privileged Accounts – Assessment Procedure
------+IA-02(05) Individual Authentication with Group Authentication – Assessment Procedure
------+IA-02(06) Access to Accounts —separate Device – Assessment Procedure
------+IA-02(08) Access to Accounts — Replay Resistant – Assessment Procedure
------+IA-02(10) Single Sign-on – Assessment Procedure
------+IA-02(12) Acceptance of PIV Credentials – Assessment Procedure
------+IA-02(13) Out-of-band Authentication – Assessment Procedure
------+IA-03 Device Identification and Authentication – Assessment Procedure
------+IA-03(01) Cryptographic Bidirectional Authentication – Assessment Procedure
------+IA-03(03) Dynamic Address Allocation – Assessment Procedure
------+IA-03(04) Device Attestation – Assessment Procedure
------+IA-04 Identifier Management – Assessment Procedure
------+IA-04(01) Prohibit Account Identifiers as Public Identifiers – Assessment Procedure
------+IA-04(04) Identify User Status – Assessment Procedure
------+IA-04(05) Dynamic Management – Assessment Procedure
------+IA-04(06) Cross-organization Management – Assessment Procedure
------+IA-04(08) Pairwise Pseudonymous Identifiers – Assessment Procedure
------+IA-04(09) Attribute Maintenance and Protection – Assessment Procedure
------+IA-05 Authenticator Management – Assessment Procedure
------+IA-05(01) Password-based Authentication – Assessment Procedure
------+IA-05(02) Public Key-based Authentication – Assessment Procedure
------+IA-05(05) Change Authenticators Prior to Delivery – Assessment Procedure
------+IA-05(06) Protection of Authenticators – Assessment Procedure
------+IA-05(07) No Embedded Unencrypted Static Authenticators – Assessment Procedure
------+IA-05(08) Multiple System Accounts – Assessment Procedure
------+IA-05(09) Federated Credential Management – Assessment Procedure
------+IA-05(10) Dynamic Credential Binding – Assessment Procedure
------+IA-05(12) Biometric Authentication Performance – Assessment Procedure
------+IA-05(13) Expiration of Cached Authenticators – Assessment Procedure
------+IA-05(14) Managing Content of PKI Trust Stores – Assessment Procedure
------+IA-05(15) GSA-approved Products and Services – Assessment Procedure
------+IA-05(16) In-person or Trusted External Party Authenticator Issuance – Assessment Procedure
------+IA-05(17) Presentation Attack Detection for Biometric Authenticators – Assessment Procedure
------+IA-05(18) Password Managers – Assessment Procedure
------+IA-06 Authentication Feedback – Assessment Procedure
------+IA-07 Cryptographic Module Authentication – Assessment Procedure
------+IA-08 Identification and Authentication (Non-organizational Users) – Assessment Procedure
------+IA-08(01) Acceptance of PIV Credentials from Other Agencies – Assessment Procedure
------+IA-08(02) Acceptance of External Authenticators – Assessment Procedure
------+IA-08(04) Use of Defined Profiles – Assessment Procedure
------+IA-08(05) Acceptance of PIV-I Credentials – Assessment Procedure
------+IA-08(06) Disassociability – Assessment Procedure
------+IA-09 Service Identification and Authentication – Assessment Procedure
------+IA-10 Adaptive Authentication – Assessment Procedure
------+IA-11 Re-authentication – Assessment Procedure
------+IA-12 Identity Proofing – Assessment Procedure
------+IA-12(01) Supervisor Authorization – Assessment Procedure
------+IA-12(02) Identity Evidence – Assessment Procedure
------+IA-12(03) Identity Evidence Validation and Verification – Assessment Procedure
------+IA-12(04) In-person Validation and Verification – Assessment Procedure
------+IA-12(05) Address Confirmation – Assessment Procedure
------+IA-12(06) Accept Externally-proofed Identities – Assessment Procedure
------+IA-13 Identity Providers and Authorization Servers – Assessment Procedure
------+IA-13(01) Protection of Cryptographic Keys – Assessment Procedure
------+IA-13(02) Verification of Identity Assertions and Access Tokens – Assessment Procedure
------+IA-13(03) Token Management – Assessment Procedure
------+IR-01 Policy and Procedures – Assessment Procedure
------+IR-02 Incident Response Training – Assessment Procedure
------+IR-02(01) Simulated Events – Assessment Procedure
------+IR-02(02) Automated Training Environments – Assessment Procedure
------+IR-02(03) Breach – Assessment Procedure
------+IR-03 Incident Response Testing – Assessment Procedure
------+IR-03(01) Automated Testing – Assessment Procedure
------+IR-03(02) Coordination with Related Plans – Assessment Procedure
------+IR-03(03) Continuous Improvement – Assessment Procedure
------+IR-04 Incident Handling – Assessment Procedure
------+IR-04(01) Automated Incident Handling Processes – Assessment Procedure
------+IR-04(02) Dynamic Reconfiguration – Assessment Procedure
------+IR-04(03) Continuity of Operations – Assessment Procedure
------+IR-04(04) Information Correlation – Assessment Procedure
------+IR-04(05) Automatic Disabling of System – Assessment Procedure
------+IR-04(06) Insider Threats – Assessment Procedure
------+IR-04(07) Insider Threats — Intra-organization Coordination – Assessment Procedure
------+IR-04(08) Correlation with External Organizations – Assessment Procedure
------+IR-04(09) Dynamic Response Capability – Assessment Procedure
------+IR-04(10) Supply Chain Coordination – Assessment Procedure
------+IR-04(11) Integrated Incident Response Team – Assessment Procedure
------+IR-04(12) Malicious Code and Forensic Analysis – Assessment Procedure
------+IR-04(13) Behavior Analysis – Assessment Procedure
------+IR-04(14) Security Operations Center – Assessment Procedure
------+IR-04(15) Public Relations and Reputation Repair – Assessment Procedure
------+IR-05 Incident Monitoring – Assessment Procedure
------+IR-05(01) Automated Tracking, Data Collection, and Analysis – Assessment Procedure
------+IR-06 Incident Reporting – Assessment Procedure
------+IR-06(01) Automated Reporting – Assessment Procedure
------+IR-06(02) Vulnerabilities Related to Incidents – Assessment Procedure
------+IR-06(03) Supply Chain Coordination – Assessment Procedure
------+IR-07 Incident Response Assistance – Assessment Procedure
------+IR-07(01) Automation Support for Availability of Information and Support – Assessment Procedure
------+IR-07(02) Coordination with External Providers – Assessment Procedure
------+IR-08 Incident Response Plan – Assessment Procedure
------+IR-08(01) Breaches – Assessment Procedure
------+IR-09 Information Spillage Response – Assessment Procedure
------+IR-09(02) Training – Assessment Procedure
------+IR-09(03) Post-spill Operations – Assessment Procedure
------+IR-09(04) Exposure to Unauthorized Personnel – Assessment Procedure
------+MA-01 Policy and Procedures – Assessment Procedure
------+MA-02 Controlled Maintenance – Assessment Procedure
------+MA-02(02) Automated Maintenance Activities – Assessment Procedure
------+MA-03 Maintenance Tools – Assessment Procedure
------+MA-03(01) Inspect Tools – Assessment Procedure
------+MA-03(02) Inspect Media – Assessment Procedure
------+MA-03(03) Prevent Unauthorized Removal – Assessment Procedure
------+MA-03(04) Restricted Tool Use – Assessment Procedure
------+MA-03(05) Execution with Privilege – Assessment Procedure
------+MA-03(06) Software Updates and Patches – Assessment Procedure
------+MA-04 Nonlocal Maintenance – Assessment Procedure
------+MA-04(01) Logging and Review – Assessment Procedure
------+MA-04(03) Comparable Security and Sanitization – Assessment Procedure
------+MA-04(04) Authentication and Separation of Maintenance Sessions – Assessment Procedure
------+MA-04(05) Approvals and Notifications – Assessment Procedure
------+MA-04(06) Cryptographic Protection – Assessment Procedure
------+MA-04(07) Disconnect Verification – Assessment Procedure
------+MA-05 Maintenance Personnel – Assessment Procedure
------+MA-05(01) Individuals Without Appropriate Access – Assessment Procedure
------+MA-05(02) Security Clearances for Classified Systems – Assessment Procedure
------+MA-05(03) Citizenship Requirements for Classified Systems – Assessment Procedure
------+MA-05(04) Foreign Nationals – Assessment Procedure
------+MA-05(05) Non-system Maintenance – Assessment Procedure
------+MA-06 Timely Maintenance – Assessment Procedure
------+MA-06(01) Preventive Maintenance – Assessment Procedure
------+MA-06(02) Predictive Maintenance – Assessment Procedure
------+MA-06(03) Automated Support for Predictive Maintenance – Assessment Procedure
------+MA-07 Field Maintenance – Assessment Procedure
------+MP-01 Policy and Procedures – Assessment Procedure
------+MP-02 Media Access – Assessment Procedure
------+MP-03 Media Marking – Assessment Procedure
------+MP-04 Media Storage – Assessment Procedure
------+MP-04(02) Automated Restricted Access – Assessment Procedure
------+MP-05 Media Transport – Assessment Procedure
------+MP-05(03) Custodians – Assessment Procedure
------+MP-06 Media Sanitization – Assessment Procedure
------+MP-06(01) Review, Approve, Track, Document, and Verify – Assessment Procedure
------+MP-06(02) Equipment Testing – Assessment Procedure
------+MP-06(03) Nondestructive Techniques – Assessment Procedure
------+MP-06(07) Dual Authorization – Assessment Procedure
------+MP-06(08) Remote Purging or Wiping of Information – Assessment Procedure
------+MP-07 Media Use – Assessment Procedure
------+MP-07(02) Prohibit Use of Sanitization-resistant Media – Assessment Procedure
------+MP-08 Media Downgrading – Assessment Procedure
------+MP-08(01) Documentation of Process – Assessment Procedure
------+MP-08(02) Equipment Testing – Assessment Procedure
------+MP-08(03) Controlled Unclassified Information – Assessment Procedure
------+MP-08(04) Classified Information – Assessment Procedure
------+PE-01 Policy and Procedures – Assessment Procedure
------+PE-02 Physical Access Authorizations – Assessment Procedure
------+PE-02(01) Access by Position or Role – Assessment Procedure
------+PE-02(02) Two Forms of Identification – Assessment Procedure
------+PE-02(03) Restrict Unescorted Access – Assessment Procedure
------+PE-03 Physical Access Control – Assessment Procedure
------+PE-03(01) System Access – Assessment Procedure
------+PE-03(02) Facility and Systems – Assessment Procedure
------+PE-03(03) Continuous Guards – Assessment Procedure
------+PE-03(04) Lockable Casings – Assessment Procedure
------+PE-03(05) Tamper Protection – Assessment Procedure
------+PE-03(07) Physical Barriers – Assessment Procedure
------+PE-03(08) Access Control Vestibules – Assessment Procedure
------+PE-04 Access Control for Transmission – Assessment Procedure
------+PE-05 Access Control for Output Devices – Assessment Procedure
------+PE-05(02) Link to Individual Identity – Assessment Procedure
------+PE-06 Monitoring Physical Access – Assessment Procedure
------+PE-06(01) Intrusion Alarms and Surveillance Equipment – Assessment Procedure
------+PE-06(02) Automated Intrusion Recognition and Responses – Assessment Procedure
------+PE-06(03) Video Surveillance – Assessment Procedure
------+PE-06(04) Monitoring Physical Access to Systems – Assessment Procedure
------+PE-08 Visitor Access Records – Assessment Procedure
------+PE-08(01) Automated Records Maintenance and Review – Assessment Procedure
------+PE-08(03) Limit Personally Identifiable Information Elements – Assessment Procedure
------+PE-09 Power Equipment and Cabling – Assessment Procedure
------+PE-09(01) Redundant Cabling – Assessment Procedure
------+PE-09(02) Automatic Voltage Controls – Assessment Procedure
------+PE-10 Emergency Shutoff – Assessment Procedure
------+PE-11 Emergency Power – Assessment Procedure
------+PE-11(01) Alternate Power Supply — Minimal Operational Capability – Assessment Procedure
------+PE-11(02) Alternate Power Supply — Self-contained – Assessment Procedure
------+PE-12 Emergency Lighting – Assessment Procedure
------+PE-12(01) Essential Mission and Business Functions – Assessment Procedure
------+PE-13 Fire Protection – Assessment Procedure
------+PE-13(01) Detection Systems — Automatic Activation and Notification – Assessment Procedure
------+PE-13(02) Suppression Systems — Automatic Activation and Notification – Assessment Procedure
------+PE-13(04) Inspections – Assessment Procedure
------+PE-14 Environmental Controls – Assessment Procedure
------+PE-14(01) Automatic Controls – Assessment Procedure
------+PE-14(02) Monitoring with Alarms and Notifications – Assessment Procedure
------+PE-15 Water Damage Protection – Assessment Procedure
------+PE-15(01) Automation Support – Assessment Procedure
------+PE-16 Delivery and Removal – Assessment Procedure
------+PE-17 Alternate Work Site – Assessment Procedure
------+PE-18 Location of System Components – Assessment Procedure
------+PE-19 Information Leakage – Assessment Procedure
------+PE-19(01) National Emissions Policies and Procedures – Assessment Procedure
------+PE-20 Asset Monitoring and Tracking – Assessment Procedure
------+PE-21 Electromagnetic Pulse Protection – Assessment Procedure
------+PE-22 Component Marking – Assessment Procedure
------+PE-23 Facility Location – Assessment Procedure
------+PL-01 Policy and Procedures – Assessment Procedure
------+PL-02 System Security and Privacy Plans – Assessment Procedure
------+PL-04 Rules of Behavior – Assessment Procedure
------+PL-04(01) Social Media and External Site/Application Usage Restrictions – Assessment Procedure
------+PL-07 Concept of Operations – Assessment Procedure
------+PL-08 Security and Privacy Architectures – Assessment Procedure
------+PL-08(01) Defense in Depth – Assessment Procedure
------+PL-08(02) Supplier Diversity – Assessment Procedure
------+PL-09 Central Management – Assessment Procedure
------+PL-10 Baseline Selection – Assessment Procedure
------+PL-11 Baseline Tailoring – Assessment Procedure
------+PM-01 Information Security Program Plan – Assessment Procedure
------+PM-02 Information Security Program Leadership Role – Assessment Procedure
------+PM-03 Information Security and Privacy Resources – Assessment Procedure
------+PM-04 Plan of Action and Milestones Process – Assessment Procedure
------+PM-05 System Inventory – Assessment Procedure
------+PM-05(01) Inventory of Personally Identifiable Information – Assessment Procedure
------+PM-06 Measures of Performance – Assessment Procedure
------+PM-07 Enterprise Architecture – Assessment Procedure
------+PM-07(01) Offloading – Assessment Procedure
------+PM-08 Critical Infrastructure Plan – Assessment Procedure
------+PM-09 Risk Management Strategy – Assessment Procedure
------+PM-10 Authorization Process – Assessment Procedure
------+PM-11 Mission and Business Process Definition – Assessment Procedure
------+PM-12 Insider Threat Program – Assessment Procedure
------+PM-13 Security and Privacy Workforce – Assessment Procedure
------+PM-14 Testing, Training, and Monitoring – Assessment Procedure
------+PM-15 Security and Privacy Groups and Associations – Assessment Procedure
------+PM-16 Threat Awareness Program – Assessment Procedure
------+PM-16(01) Automated Means for Sharing Threat Intelligence – Assessment Procedure
------+PM-17 Protecting Controlled Unclassified Information on External Systems – Assessment Procedure
------+PM-18 Privacy Program Plan – Assessment Procedure
------+PM-19 Privacy Program Leadership Role – Assessment Procedure
------+PM-20 Dissemination of Privacy Program Information – Assessment Procedure
------+PM-20(01) Privacy Policies on Websites, Applications, and Digital Services – Assessment Procedure
------+PM-21 Accounting of Disclosures – Assessment Procedure
------+PM-22 Personally Identifiable Information Quality Management – Assessment Procedure
------+PM-23 Data Governance Body – Assessment Procedure
------+PM-24 Data Integrity Board – Assessment Procedure
------+PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research – Assessment Procedure
------+PM-26 Complaint Management – Assessment Procedure
------+PM-27 Privacy Reporting – Assessment Procedure
------+PM-28 Risk Framing – Assessment Procedure
------+PM-29 Risk Management Program Leadership Roles – Assessment Procedure
------+PM-30 Supply Chain Risk Management Strategy – Assessment Procedure
------+PM-30(01) Suppliers of Critical or Mission-essential Items – Assessment Procedure
------+PM-31 Continuous Monitoring Strategy – Assessment Procedure
------+PM-32 Purposing – Assessment Procedure
------+PS-01 Policy and Procedures – Assessment Procedure
------+PS-02 Position Risk Designation – Assessment Procedure
------+PS-03 Personnel Screening – Assessment Procedure
------+PS-03(01) Classified Information – Assessment Procedure
------+PS-03(02) Formal Indoctrination – Assessment Procedure
------+PS-03(03) Information Requiring Special Protective Measures – Assessment Procedure
------+PS-03(04) Citizenship Requirements – Assessment Procedure
------+PS-04 Personnel Termination – Assessment Procedure
------+PS-04(01) Post-employment Requirements – Assessment Procedure
------+PS-04(02) Automated Actions – Assessment Procedure
------+PS-05 Personnel Transfer – Assessment Procedure
------+PS-06 Access Agreements – Assessment Procedure
------+PS-06(02) Classified Information Requiring Special Protection – Assessment Procedure
------+PS-06(03) Post-employment Requirements – Assessment Procedure
------+PS-07 External Personnel Security – Assessment Procedure
------+PS-08 Personnel Sanctions – Assessment Procedure
------+PS-09 Position Descriptions – Assessment Procedure
------+PT-01 Policy and Procedures – Assessment Procedure
------+PT-02 Authority to Process Personally Identifiable Information – Assessment Procedure
------+PT-02(01) Data Tagging – Assessment Procedure
------+PT-02(02) Automation – Assessment Procedure
------+PT-03 Personally Identifiable Information Processing Purposes – Assessment Procedure
------+PT-03(01) Data Tagging – Assessment Procedure
------+PT-03(02) Automation – Assessment Procedure
------+PT-04 Consent – Assessment Procedure
------+PT-04(01) Tailored Consent – Assessment Procedure
------+PT-04(02) Just-in-time Consent – Assessment Procedure
------+PT-04(03) Revocation – Assessment Procedure
------+PT-05 Privacy Notice – Assessment Procedure
------+PT-05(01) Just-in-time Notice – Assessment Procedure
------+PT-05(02) Privacy Act Statements – Assessment Procedure
------+PT-06 System of Records Notice – Assessment Procedure
------+PT-06(01) Routine Uses – Assessment Procedure
------+PT-06(02) Exemption Rules – Assessment Procedure
------+PT-07 Specific Categories of Personally Identifiable Information – Assessment Procedure
------+PT-07(01) Social Security Numbers – Assessment Procedure
------+PT-07(02) First Amendment Information – Assessment Procedure
------+PT-08 Computer Matching Requirements – Assessment Procedure
------+RA-01 Policy and Procedures – Assessment Procedure
------+RA-02 Security Categorization – Assessment Procedure
------+RA-02(01) Impact-level Prioritization – Assessment Procedure
------+RA-03 Risk Assessment – Assessment Procedure
------+RA-03(01) Supply Chain Risk Assessment – Assessment Procedure
------+RA-03(02) Use of All-source Intelligence – Assessment Procedure
------+RA-03(03) Dynamic Threat Awareness – Assessment Procedure
------+RA-03(04) Predictive Cyber Analytics – Assessment Procedure
------+RA-05 Vulnerability Monitoring and Scanning – Assessment Procedure
------+RA-05(02) Update Vulnerabilities to Be Scanned – Assessment Procedure
------+RA-05(03) Breadth and Depth of Coverage – Assessment Procedure
------+RA-05(04) Discoverable Information – Assessment Procedure
------+RA-05(05) Privileged Access – Assessment Procedure
------+RA-05(06) Automated Trend Analyses – Assessment Procedure
------+RA-05(08) Review Historic Audit Logs – Assessment Procedure
------+RA-05(10) Correlate Scanning Information – Assessment Procedure
------+RA-05(11) Public Disclosure Program – Assessment Procedure
------+RA-06 Technical Surveillance Countermeasures Survey – Assessment Procedure
------+RA-07 Risk Response – Assessment Procedure
------+RA-08 Privacy Impact Assessments – Assessment Procedure
------+RA-09 Criticality Analysis – Assessment Procedure
------+RA-10 Threat Hunting – Assessment Procedure
------+SA-01 Policy and Procedures – Assessment Procedure
------+SA-02 Allocation of Resources – Assessment Procedure
------+SA-03 System Development Life Cycle – Assessment Procedure
------+SA-03(01) Manage Preproduction Environment – Assessment Procedure
------+SA-03(02) Use of Live or Operational Data – Assessment Procedure
------+SA-03(03) Technology Refresh – Assessment Procedure
------+SA-04 Acquisition Process – Assessment Procedure
------+SA-04(01) Functional Properties of Controls – Assessment Procedure
------+SA-04(02) Design and Implementation Information for Controls – Assessment Procedure
------+SA-04(03) Development Methods, Techniques, and Practices – Assessment Procedure
------+SA-04(05) System, Component, and Service Configurations – Assessment Procedure
------+SA-04(06) Use of Information Assurance Products – Assessment Procedure
------+SA-04(07) NIAP-approved Protection Profiles – Assessment Procedure
------+SA-04(08) Continuous Monitoring Plan for Controls – Assessment Procedure
------+SA-04(09) Functions, Ports, Protocols, and Services in Use – Assessment Procedure
------+SA-04(10) Use of Approved PIV Products – Assessment Procedure
------+SA-04(11) System of Records – Assessment Procedure
------+SA-04(12) Data Ownership – Assessment Procedure
------+SA-05 System Documentation – Assessment Procedure
------+SA-08 Security and Privacy Engineering Principles – Assessment Procedure
------+SA-08(01) Clear Abstractions – Assessment Procedure
------+SA-08(02) Least Common Mechanism – Assessment Procedure
------+SA-08(03) Modularity and Layering – Assessment Procedure
------+SA-08(04) Partially Ordered Dependencies – Assessment Procedure
------+SA-08(05) Efficiently Mediated Access – Assessment Procedure
------+SA-08(06) Minimized Sharing – Assessment Procedure
------+SA-08(07) Reduced Complexity – Assessment Procedure
------+SA-08(08) Secure Evolvability – Assessment Procedure
------+SA-08(09) Trusted Components – Assessment Procedure
------+SA-08(10) Hierarchical Trust – Assessment Procedure
------+SA-08(11) Inverse Modification Threshold – Assessment Procedure
------+SA-08(12) Hierarchical Protection – Assessment Procedure
------+SA-08(13) Minimized Security Elements – Assessment Procedure
------+SA-08(14) Least Privilege – Assessment Procedure
------+SA-08(15) Predicate Permission – Assessment Procedure
------+SA-08(16) Self-reliant Trustworthiness – Assessment Procedure
------+SA-08(17) Secure Distributed Composition – Assessment Procedure
------+SA-08(18) Trusted Communications Channels – Assessment Procedure
------+SA-08(19) Continuous Protection – Assessment Procedure
------+SA-08(20) Secure Metadata Management – Assessment Procedure
------+SA-08(21) Self-analysis – Assessment Procedure
------+SA-08(22) Accountability and Traceability – Assessment Procedure
------+SA-08(23) Secure Defaults – Assessment Procedure
------+SA-08(24) Secure Failure and Recovery – Assessment Procedure
------+SA-08(25) Economic Security – Assessment Procedure
------+SA-08(26) Performance Security – Assessment Procedure
------+SA-08(27) Human Factored Security – Assessment Procedure
------+SA-08(28) Acceptable Security – Assessment Procedure
------+SA-08(29) Repeatable and Documented Procedures – Assessment Procedure
------+SA-08(30) Procedural Rigor – Assessment Procedure
------+SA-08(31) Secure System Modification – Assessment Procedure
------+SA-08(32) Sufficient Documentation – Assessment Procedure
------+SA-08(33) Minimization – Assessment Procedure
------+SA-09 External System Services – Assessment Procedure
------+SA-09(01) Risk Assessments and Organizational Approvals – Assessment Procedure
------+SA-09(02) Identification of Functions, Ports, Protocols, and Services – Assessment Procedure
------+SA-09(03) Establish and Maintain Trust Relationship with Providers – Assessment Procedure
------+SA-09(04) Consistent Interests of Consumers and Providers – Assessment Procedure
------+SA-09(05) Processing, Storage, and Service Location – Assessment Procedure
------+SA-09(06) Organization-controlled Cryptographic Keys – Assessment Procedure
------+SA-09(07) Organization-controlled Integrity Checking – Assessment Procedure
------+SA-09(08) Processing and Storage Location — U.S. Jurisdiction – Assessment Procedure
------+SA-10 Developer Configuration Management – Assessment Procedure
------+SA-10(01) Software and Firmware Integrity Verification – Assessment Procedure
------+SA-10(02) Alternative Configuration Management Processes – Assessment Procedure
------+SA-10(03) Hardware Integrity Verification – Assessment Procedure
------+SA-10(04) Trusted Generation – Assessment Procedure
------+SA-10(05) Mapping Integrity for Version Control – Assessment Procedure
------+SA-10(06) Trusted Distribution – Assessment Procedure
------+SA-10(07) Security and Privacy Representatives – Assessment Procedure
------+SA-11 Developer Testing and Evaluation – Assessment Procedure
------+SA-11(01) Static Code Analysis – Assessment Procedure
------+SA-11(02) Threat Modeling and Vulnerability Analyses – Assessment Procedure
------+SA-11(03) Independent Verification of Assessment Plans and Evidence – Assessment Procedure
------+SA-11(04) Manual Code Reviews – Assessment Procedure
------+SA-11(05) Penetration Testing – Assessment Procedure
------+SA-11(06) Attack Surface Reviews – Assessment Procedure
------+SA-11(07) Verify Scope of Testing and Evaluation – Assessment Procedure
------+SA-11(08) Dynamic Code Analysis – Assessment Procedure
------+SA-11(09) Interactive Application Security Testing – Assessment Procedure
------+SA-15 Development Process, Standards, and Tools – Assessment Procedure
------+SA-15(01) Quality Metrics – Assessment Procedure
------+SA-15(02) Security and Privacy Tracking Tools – Assessment Procedure
------+SA-15(03) Criticality Analysis – Assessment Procedure
------+SA-15(05) Attack Surface Reduction – Assessment Procedure
------+SA-15(06) Continuous Improvement – Assessment Procedure
------+SA-15(07) Automated Vulnerability Analysis – Assessment Procedure
------+SA-15(08) Reuse of Threat and Vulnerability Information – Assessment Procedure
------+SA-15(10) Incident Response Plan – Assessment Procedure
------+SA-15(11) Archive System or Component – Assessment Procedure
------+SA-15(12) Minimize Personally Identifiable Information – Assessment Procedure
------+SA-15(13) Logging Syntax – Assessment Procedure
------+SA-16 Developer-provided Training – Assessment Procedure
------+SA-17 Developer Security and Privacy Architecture and Design – Assessment Procedure
------+SA-17(01) Formal Policy Model – Assessment Procedure
------+SA-17(02) Security-relevant Components – Assessment Procedure
------+SA-17(03) Formal Correspondence – Assessment Procedure
------+SA-17(04) Informal Correspondence – Assessment Procedure
------+SA-17(05) Conceptually Simple Design – Assessment Procedure
------+SA-17(06) Structure for Testing – Assessment Procedure
------+SA-17(07) Structure for Least Privilege – Assessment Procedure
------+SA-17(08) Orchestration – Assessment Procedure
------+SA-17(09) Design Diversity – Assessment Procedure
------+SA-20 Customized Development of Critical Components – Assessment Procedure
------+SA-21 Developer Screening – Assessment Procedure
------+SA-22 Unsupported System Components – Assessment Procedure
------+SA-23 Specialization – Assessment Procedure
------+SA-24 Design For Cyber Resiliency – Assessment Procedure
------+SC-01 Policy and Procedures – Assessment Procedure
------+SC-02 Separation of System and User Functionality – Assessment Procedure
------+SC-02(01) Interfaces for Non-privileged Users – Assessment Procedure
------+SC-02(02) Disassociability – Assessment Procedure
------+SC-03 Security Function Isolation – Assessment Procedure
------+SC-03(01) Hardware Separation – Assessment Procedure
------+SC-03(02) Access and Flow Control Functions – Assessment Procedure
------+SC-03(03) Minimize Nonsecurity Functionality – Assessment Procedure
------+SC-03(04) Module Coupling and Cohesiveness – Assessment Procedure
------+SC-03(05) Layered Structures – Assessment Procedure
------+SC-04 Information in Shared System Resources – Assessment Procedure
------+SC-04(02) Multilevel or Periods Processing – Assessment Procedure
------+SC-05 Denial-of-service Protection – Assessment Procedure
------+SC-05(01) Restrict Ability to Attack Other Systems – Assessment Procedure
------+SC-05(02) Capacity, Bandwidth, and Redundancy – Assessment Procedure
------+SC-05(03) Detection and Monitoring – Assessment Procedure
------+SC-06 Resource Availability – Assessment Procedure
------+SC-07 Boundary Protection – Assessment Procedure
------+SC-07(03) Access Points – Assessment Procedure
------+SC-07(04) External Telecommunications Services – Assessment Procedure
------+SC-07(05) Deny by Default — Allow by Exception – Assessment Procedure
------+SC-07(07) Split Tunneling for Remote Devices – Assessment Procedure
------+SC-07(08) Route Traffic to Authenticated Proxy Servers – Assessment Procedure
------+SC-07(09) Restrict Threatening Outgoing Communications Traffic – Assessment Procedure
------+SC-07(10) Prevent Exfiltration – Assessment Procedure
------+SC-07(11) Restrict Incoming Communications Traffic – Assessment Procedure
------+SC-07(12) Host-based Protection – Assessment Procedure
------+SC-07(13) Isolation of Security Tools, Mechanisms, and Support Components – Assessment Procedure
------+SC-07(14) Protect Against Unauthorized Physical Connections – Assessment Procedure
------+SC-07(15) Networked Privileged Accesses – Assessment Procedure
------+SC-07(16) Prevent Discovery of System Components – Assessment Procedure
------+SC-07(17) Automated Enforcement of Protocol Formats – Assessment Procedure
------+SC-07(18) Fail Secure – Assessment Procedure
------+SC-07(19) Block Communication from Non-organizationally Configured Hosts – Assessment Procedure
------+SC-07(20) Dynamic Isolation and Segregation – Assessment Procedure
------+SC-07(21) Isolation of System Components – Assessment Procedure
------+SC-07(22) Separate Subnets for Connecting to Different Security Domains – Assessment Procedure
------+SC-07(23) Disable Sender Feedback on Protocol Validation Failure – Assessment Procedure
------+SC-07(24) Personally Identifiable Information – Assessment Procedure
------+SC-07(25) Unclassified National Security System Connections – Assessment Procedure
------+SC-07(26) Classified National Security System Connections – Assessment Procedure
------+SC-07(27) Unclassified Non-national Security System Connections – Assessment Procedure
------+SC-07(28) Connections to Public Networks – Assessment Procedure
------+SC-07(29) Separate Subnets to Isolate Functions – Assessment Procedure
------+SC-08 Transmission Confidentiality and Integrity – Assessment Procedure
------+SC-08(01) Cryptographic Protection – Assessment Procedure
------+SC-08(02) Pre- and Post-transmission Handling – Assessment Procedure
------+SC-08(03) Cryptographic Protection for Message Externals – Assessment Procedure
------+SC-08(04) Conceal or Randomize Communications – Assessment Procedure
------+SC-08(05) Protected Distribution System – Assessment Procedure
------+SC-10 Network Disconnect – Assessment Procedure
------+SC-11 Trusted Path – Assessment Procedure
------+SC-11(01) Irrefutable Communications Path – Assessment Procedure
------+SC-12 Cryptographic Key Establishment and Management – Assessment Procedure
------+SC-12(01) Availability – Assessment Procedure
------+SC-12(02) Symmetric Keys – Assessment Procedure
------+SC-12(03) Asymmetric Keys – Assessment Procedure
------+SC-12(06) Physical Control of Keys – Assessment Procedure
------+SC-13 Cryptographic Protection – Assessment Procedure
------+SC-15 Collaborative Computing Devices and Applications – Assessment Procedure
------+SC-15(01) Physical or Logical Disconnect – Assessment Procedure
------+SC-15(03) Disabling and Removal in Secure Work Areas – Assessment Procedure
------+SC-15(04) Explicitly Indicate Current Participants – Assessment Procedure
------+SC-16 Transmission of Security and Privacy Attributes – Assessment Procedure
------+SC-16(01) Integrity Verification – Assessment Procedure
------+SC-16(02) Anti-spoofing Mechanisms – Assessment Procedure
------+SC-16(03) Cryptographic Binding – Assessment Procedure
------+SC-17 Public Key Infrastructure Certificates – Assessment Procedure
------+SC-18 Mobile Code – Assessment Procedure
------+SC-18(01) Identify Unacceptable Code and Take Corrective Actions – Assessment Procedure
------+SC-18(02) Acquisition, Development, and Use – Assessment Procedure
------+SC-18(03) Prevent Downloading and Execution – Assessment Procedure
------+SC-18(04) Prevent Automatic Execution – Assessment Procedure
------+SC-18(05) Allow Execution Only in Confined Environments – Assessment Procedure
------+SC-20 Secure Name/Address Resolution Service (Authoritative Source) – Assessment Procedure
------+SC-20(02) Data Origin and Integrity – Assessment Procedure
------+SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) – Assessment Procedure
------+SC-22 Architecture and Provisioning for Name/Address Resolution Service – Assessment Procedure
------+SC-23 Session Authenticity – Assessment Procedure
------+SC-23(01) Invalidate Session Identifiers at Logout – Assessment Procedure
------+SC-23(03) Unique System-generated Session Identifiers – Assessment Procedure
------+SC-23(05) Allowed Certificate Authorities – Assessment Procedure
------+SC-24 Fail in Known State – Assessment Procedure
------+SC-25 Thin Nodes – Assessment Procedure
------+SC-26 Decoys – Assessment Procedure
------+SC-27 Platform-independent Applications – Assessment Procedure
------+SC-28 Protection of Information at Rest – Assessment Procedure
------+SC-28(01) Cryptographic Protection – Assessment Procedure
------+SC-28(02) Offline Storage – Assessment Procedure
------+SC-28(03) Cryptographic Keys – Assessment Procedure
------+SC-29 Heterogeneity – Assessment Procedure
------+SC-29(01) Virtualization Techniques – Assessment Procedure
------+SC-30 Concealment and Misdirection – Assessment Procedure
------+SC-30(02) Randomness – Assessment Procedure
------+SC-30(03) Change Processing and Storage Locations – Assessment Procedure
------+SC-30(04) Misleading Information – Assessment Procedure
------+SC-30(05) Concealment of System Components – Assessment Procedure
------+SC-31 Covert Channel Analysis – Assessment Procedure
------+SC-31(01) Test Covert Channels for Exploitability – Assessment Procedure
------+SC-31(02) Maximum Bandwidth – Assessment Procedure
------+SC-31(03) Measure Bandwidth in Operational Environments – Assessment Procedure
------+SC-32 System Partitioning – Assessment Procedure
------+SC-32(01) Separate Physical Domains for Privileged Functions – Assessment Procedure
------+SC-34 Non-modifiable Executable Programs – Assessment Procedure
------+SC-34(01) No Writable Storage – Assessment Procedure
------+SC-34(02) Integrity Protection on Read-only Media – Assessment Procedure
------+SC-35 External Malicious Code Identification – Assessment Procedure
------+SC-36 Distributed Processing and Storage – Assessment Procedure
------+SC-36(01) Polling Techniques – Assessment Procedure
------+SC-36(02) Synchronization – Assessment Procedure
------+SC-37 Out-of-band Channels – Assessment Procedure
------+SC-37(01) Ensure Delivery and Transmission – Assessment Procedure
------+SC-38 Operations Security – Assessment Procedure
------+SC-39 Process Isolation – Assessment Procedure
------+SC-39(01) Hardware Separation – Assessment Procedure
------+SC-39(02) Separate Execution Domain Per Thread – Assessment Procedure
------+SC-40 Wireless Link Protection – Assessment Procedure
------+SC-40(01) Electromagnetic Interference – Assessment Procedure
------+SC-40(02) Reduce Detection Potential – Assessment Procedure
------+SC-40(03) Imitative or Manipulative Communications Deception – Assessment Procedure
------+SC-40(04) Signal Parameter Identification – Assessment Procedure
------+SC-41 Port and I/O Device Access – Assessment Procedure
------+SC-42 Sensor Capability and Data – Assessment Procedure
------+SC-42(01) Reporting to Authorized Individuals or Roles – Assessment Procedure
------+SC-42(02) Authorized Use – Assessment Procedure
------+SC-42(04) Notice of Collection – Assessment Procedure
------+SC-42(05) Collection Minimization – Assessment Procedure
------+SC-43 Usage Restrictions – Assessment Procedure
------+SC-44 Detonation Chambers – Assessment Procedure
------+SC-45 System Time Synchronization – Assessment Procedure
------+SC-45(01) Synchronization with Authoritative Time Source – Assessment Procedure
------+SC-45(02) Secondary Authoritative Time Source – Assessment Procedure
------+SC-46 Cross Domain Policy Enforcement – Assessment Procedure
------+SC-47 Alternate Communications Paths – Assessment Procedure
------+SC-48 Sensor Relocation – Assessment Procedure
------+SC-48(01) Dynamic Relocation of Sensors or Monitoring Capabilities – Assessment Procedure
------+SC-49 Hardware-enforced Separation and Policy Enforcement – Assessment Procedure
------+SC-50 Software-enforced Separation and Policy Enforcement – Assessment Procedure
------+SC-51 Hardware-based Protection – Assessment Procedure
------+SI-01 Policy and Procedures – Assessment Procedure
------+SI-02 Flaw Remediation – Assessment Procedure
------+SI-02(02) Automated Flaw Remediation Status – Assessment Procedure
------+SI-02(03) Time to Remediate Flaws and Benchmarks for Corrective Actions – Assessment Procedure
------+SI-02(04) Automated Patch Management Tools – Assessment Procedure
------+SI-02(05) Automatic Software and Firmware Updates – Assessment Procedure
------+SI-02(06) Removal of Previous Versions of Software and Firmware – Assessment Procedure
------+SI-02(07) Root Cause Analysis – Assessment Procedure
------+SI-03 Malicious Code Protection – Assessment Procedure
------+SI-03(04) Updates Only by Privileged Users – Assessment Procedure
------+SI-03(06) Testing and Verification – Assessment Procedure
------+SI-03(08) Detect Unauthorized Commands – Assessment Procedure
------+SI-03(10) Malicious Code Analysis – Assessment Procedure
------+SI-04 System Monitoring – Assessment Procedure
------+SI-04(01) System-wide Intrusion Detection System – Assessment Procedure
------+SI-04(02) Automated Tools and Mechanisms for Real-time Analysis – Assessment Procedure
------+SI-04(03) Automated Tool and Mechanism Integration – Assessment Procedure
------+SI-04(04) Inbound and Outbound Communications Traffic – Assessment Procedure
------+SI-04(05) System-generated Alerts – Assessment Procedure
------+SI-04(07) Automated Response to Suspicious Events – Assessment Procedure
------+SI-04(09) Testing of Monitoring Tools and Mechanisms – Assessment Procedure
------+SI-04(10) Visibility of Encrypted Communications – Assessment Procedure
------+SI-04(11) Analyze Communications Traffic Anomalies – Assessment Procedure
------+SI-04(12) Automated Organization-generated Alerts – Assessment Procedure
------+SI-04(13) Analyze Traffic and Event Patterns – Assessment Procedure
------+SI-04(14) Wireless Intrusion Detection – Assessment Procedure
------+SI-04(15) Wireless to Wireline Communications – Assessment Procedure
------+SI-04(16) Correlate Monitoring Information – Assessment Procedure
------+SI-04(17) Integrated Situational Awareness – Assessment Procedure
------+SI-04(18) Analyze Traffic and Covert Exfiltration – Assessment Procedure
------+SI-04(19) Risk for Individuals – Assessment Procedure
------+SI-04(20) Privileged Users – Assessment Procedure
------+SI-04(21) Probationary Periods – Assessment Procedure
------+SI-04(22) Unauthorized Network Services – Assessment Procedure
------+SI-04(23) Host-based Devices – Assessment Procedure
------+SI-04(24) Indicators of Compromise – Assessment Procedure
------+SI-04(25) Optimize Network Traffic Analysis – Assessment Procedure
------+SI-05 Security Alerts, Advisories, and Directives – Assessment Procedure
------+SI-05(01) Automated Alerts and Advisories – Assessment Procedure
------+SI-06 Security and Privacy Function Verification – Assessment Procedure
------+SI-06(02) Automation Support for Distributed Testing – Assessment Procedure
------+SI-06(03) Report Verification Results – Assessment Procedure
------+SI-07 Software, Firmware, and Information Integrity – Assessment Procedure
------+SI-07(01) Integrity Checks – Assessment Procedure
------+SI-07(02) Automated Notifications of Integrity Violations – Assessment Procedure
------+SI-07(03) Centrally Managed Integrity Tools – Assessment Procedure
------+SI-07(05) Automated Response to Integrity Violations – Assessment Procedure
------+SI-07(06) Cryptographic Protection – Assessment Procedure
------+SI-07(07) Integration of Detection and Response – Assessment Procedure
------+SI-07(08) Auditing Capability for Significant Events – Assessment Procedure
------+SI-07(09) Verify Boot Process – Assessment Procedure
------+SI-07(10) Protection of Boot Firmware – Assessment Procedure
------+SI-07(12) Integrity Verification – Assessment Procedure
------+SI-07(15) Code Authentication – Assessment Procedure
------+SI-07(16) Time Limit on Process Execution Without Supervision – Assessment Procedure
------+SI-07(17) Runtime Application Self-protection – Assessment Procedure
------+SI-08 Spam Protection – Assessment Procedure
------+SI-08(02) Automatic Updates – Assessment Procedure
------+SI-08(03) Continuous Learning Capability – Assessment Procedure
------+SI-10 Information Input Validation – Assessment Procedure
------+SI-10(01) Manual Override Capability – Assessment Procedure
------+SI-10(02) Review and Resolve Errors – Assessment Procedure
------+SI-10(03) Predictable Behavior – Assessment Procedure
------+SI-10(04) Timing Interactions – Assessment Procedure
------+SI-10(05) Restrict Inputs to Trusted Sources and Approved Formats – Assessment Procedure
------+SI-10(06) Injection Prevention – Assessment Procedure
------+SI-11 Error Handling – Assessment Procedure
------+SI-12 Information Management and Retention – Assessment Procedure
------+SI-12(01) Limit Personally Identifiable Information Elements – Assessment Procedure
------+SI-12(02) Minimize Personally Identifiable Information in Testing, Training, and Research – Assessment Procedure
------+SI-12(03) Information Disposal – Assessment Procedure
------+SI-13 Predictable Failure Prevention – Assessment Procedure
------+SI-13(01) Transferring Component Responsibilities – Assessment Procedure
------+SI-13(03) Manual Transfer Between Components – Assessment Procedure
------+SI-13(04) Standby Component Installation and Notification – Assessment Procedure
------+SI-13(05) Failover Capability – Assessment Procedure
------+SI-14 Non-persistence – Assessment Procedure
------+SI-14(01) Refresh from Trusted Sources – Assessment Procedure
------+SI-14(02) Non-persistent Information – Assessment Procedure
------+SI-14(03) Non-persistent Connectivity – Assessment Procedure
------+SI-15 Information Output Filtering – Assessment Procedure
------+SI-16 Memory Protection – Assessment Procedure
------+SI-17 Fail-safe Procedures – Assessment Procedure
------+SI-18 Personally Identifiable Information Quality Operations – Assessment Procedure
------+SI-18(01) Automation Support – Assessment Procedure
------+SI-18(02) Data Tags – Assessment Procedure
------+SI-18(03) Collection – Assessment Procedure
------+SI-18(04) Individual Requests – Assessment Procedure
------+SI-18(05) Notice of Correction or Deletion – Assessment Procedure
------+SI-19 De-identification – Assessment Procedure
------+SI-19(01) Collection – Assessment Procedure
------+SI-19(02) Archiving – Assessment Procedure
------+SI-19(03) Release – Assessment Procedure
------+SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers – Assessment Procedure
------+SI-19(05) Statistical Disclosure Control – Assessment Procedure
------+SI-19(06) Differential Privacy – Assessment Procedure
------+SI-19(07) Validated Algorithms and Software – Assessment Procedure
------+SI-19(08) Motivated Intruder – Assessment Procedure
------+SI-20 Tainting – Assessment Procedure
------+SI-21 Information Refresh – Assessment Procedure
------+SI-22 Information Diversity – Assessment Procedure
------+SI-23 Information Fragmentation – Assessment Procedure
------+SR-01 Policy and Procedures – Assessment Procedure
------+SR-02 Supply Chain Risk Management Plan – Assessment Procedure
------+SR-02(01) Establish SCRM Team – Assessment Procedure
------+SR-03 Supply Chain Controls and Processes – Assessment Procedure
------+SR-03(01) Diverse Supply Base – Assessment Procedure
------+SR-03(02) Limitation of Harm – Assessment Procedure
------+SR-03(03) Sub-tier Flow Down – Assessment Procedure
------+SR-04 Provenance – Assessment Procedure
------+SR-04(01) Identity – Assessment Procedure
------+SR-04(02) Track and Trace – Assessment Procedure
------+SR-04(03) Validate as Genuine and Not Altered – Assessment Procedure
------+SR-04(04) Supply Chain Integrity — Pedigree – Assessment Procedure
------+SR-05 Acquisition Strategies, Tools, and Methods – Assessment Procedure
------+SR-05(01) Adequate Supply – Assessment Procedure
------+SR-05(02) Assessments Prior to Selection, Acceptance, Modification, or Update – Assessment Procedure
------+SR-06 Supplier Assessments and Reviews – Assessment Procedure
------+SR-06(01) Testing and Analysis – Assessment Procedure
------+SR-07 Supply Chain Operations Security – Assessment Procedure
------+SR-08 Notification Agreements – Assessment Procedure
------+SR-09 Tamper Resistance and Detection – Assessment Procedure
------+SR-09(01) Multiple Stages of System Development Life Cycle – Assessment Procedure
------+SR-10 Inspection of Systems or Components – Assessment Procedure
------+SR-11 Component Authenticity – Assessment Procedure
------+SR-11(01) Anti-counterfeit Training – Assessment Procedure
------+SR-11(02) Configuration Control for Component Service and Repair – Assessment Procedure
------+SR-11(03) Anti-counterfeit Scanning – Assessment Procedure
------+SR-12 Component Disposal – Assessment Procedure

Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures

Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures

1. Przegląd

Tytuł	Norma
AC Access Control	Access Control
AT Awareness and Training	Awareness and Training
AU Audit and Accountability	Audit and Accountability
CA Assessment, Authorization, and Monitoring	Assessment, Authorization, and Monitoring
CM Configuration Management	Configuration Management
CP Contingency Planning	Contingency Planning
IA Identification and Authentication	Identification and Authentication
IR Incident Response	Incident Response
MA Maintenance	Maintenance
MP Media Protection	Media Protection
PE Physical and Environmental Protection	Physical and Environmental Protection
PL Planning	Planning
PM Program Management	Program Management
PS Personnel Security	Personnel Security
PT Personally Identifiable Information Processing and Transparency	Personally Identifiable Information Processing and Transparency
RA Risk Assessment	Risk Assessment
SA System and Services Acquisition	System and Services Acquisition
SC System and Communications Protection	System and Communications Protection
SI System and Information Integrity	System and Information Integrity
SR Supply Chain Risk Management	Supply Chain Risk Management

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania
Źródło	Wymaganie

3. Powiązane regulacje

Regulacje
Źródło	Regulacja

Powiązane zgłoszenia

Powiązania
Typ powiązania	Zgłoszenie
is related to	English
is related to	Information Security
is related to	New version: NIST SP 800-53 Rev. 5 (v1.5.0-8ebe3c9118) – 714 new, 0 changed, 0 removed
is related to	New version: NIST SP 800-53 Rev. 5 (v1.5.0-8ebe3c9118) – 1015 new, 0 changed, 0 removed, 1014 links
includes	NIST SP 800-53 Rev. 5 – Assessment Procedures

NIST -
https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final